library-mirrors/jquery-ui
1
0
Fork 0
mirror of https://github.com/jquery/jquery-ui.git synced 2024-11-21 11:04:24 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Widget: Don't let widget name affect $.ui prototype & constructor

Browse Source 
This is an edge case and it only affects code accepting untrusted input as
a widget name, but it's still technically correct to filter these out.

Closes gh-2310
This commit is contained in:
Michał Gołębiowski-Owczarek 2024-10-30 09:58:01 +01:00 committed by GitHub
parent 85bed8ddd8
commit d591bdd494
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
tests/unit/widget/core.js
View File

@ -242,6 +242,28 @@ QUnit.test( "error handling", function( assert ) {
$.error = error;
} );
QUnit.test( "Prototype pollution", function( assert ) {
assert.expect( 3 );
var elem = $( "<div>" );
$.widget( "ui.testWidget", {} );
elem.testWidget();
try {
$.widget( "ui.__proto__", {} );
} catch ( _e ) {}
try {
$.widget( "ui.constructor", {} );
} catch ( _e ) {}
assert.strictEqual( Object.getPrototypeOf( $.ui ), Object.prototype,
"$.ui constructor not modified" );
assert.ok( $.ui instanceof Object, "$.ui is an Object instance" );
assert.notOk( $.ui instanceof Function, "$.ui is not a Function instance" );
} );
QUnit.test( "merge multiple option arguments", function( assert ) {
assert.expect( 1 );
$.widget( "ui.testWidget", {

3
ui/widget.js
View File

@ -56,6 +56,9 @@ $.widget = function( name, base, prototype ) {
var namespace = name.split( "." )[ 0 ];
name = name.split( "." )[ 1 ];
if ( name === "__proto__" || name === "constructor" ) {
return $.error( "Invalid widget name: " + name );
}
var fullName = namespace + "-" + name;
if ( !prototype ) {