Skip to content

Conversation

aplhk
Copy link

@aplhk aplhk commented Nov 13, 2022

Hi there, I found a potential prototype pollution in the metadata setter setSongMetaData and setPlaylistMetaData under some specific condition.

Here is the sample code:

let obj = {};
Amplitude.addPlaylist("__proto__", {}, []);
Amplitude.setPlaylistMetaData("__proto__", { a: "pollution" });
console.log(obj.a); // output: pollution

Expected behaviour: obj.a should be undefined.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant