Add tests for protoype pollution

Raynos · May 13, 2018 · 9655c70 · 9655c70
1 parent 82bd7f0
commit 9655c70
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/test.js b/test.js
@@ -81,3 +81,23 @@ test("null prototype mutable", function (assert) {
     assert.equal(a.bar, "baz")
     assert.end()
 })
+
+test("prototype pollution", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    extend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})
+
+test("prototype pollution mutable", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    mutableExtend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})