github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-09-07 15:07:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(player): use hasOwnProperty for the device-status guard

Browse Source 
CodeQL alert 318 (js/remote-property-injection). setDevices guarded
the status_update write with a plain "!prev[msg.deviceId]" truthy
check; a deviceId of "__proto__" or "constructor" resolves through
the prototype chain to a truthy value, so it would pass the guard
despite not being a real known device, letting the spread write a
bogus own-property (not actual prototype pollution -- computed keys
in object literals use [[DefineOwnProperty]], not the legacy __proto__
setter -- but still corrupts the rendered device list). Use
Object.prototype.hasOwnProperty.call for a real own-property check;
avoided Object.hasOwn (ES2022, Safari 15.4+) given #649's recent
Safari-15.0 compatibility work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-08-29 23:19:32 +02:00
co-authored by Claude Sonnet 5
parent ed09141175
commit 966214c5a0
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/soundtouchweb/static/js/app.js
+5 -1
View File
@@ -115,7 +115,11 @@ function App() {
}
} else if (msg.type === 'status_update' && msg.deviceId) {
setDevices(prev => {
if (!prev[msg.deviceId]) return prev;
// Object.prototype.hasOwnProperty, not a plain prev[msg.deviceId]
// truthy check: a deviceId of "__proto__" or "constructor" would
// otherwise resolve through the prototype chain to a truthy value
// and pass the check despite not being a real, known device.
if (!Object.prototype.hasOwnProperty.call(prev, msg.deviceId)) return prev;
return {
...prev,
[msg.deviceId]: { ...prev[msg.deviceId], status: msg.data },