We write out the API (node ββmodule), and we have the following code fragment:
function myFunc(dataFromUser){ var dataArr = Object.keys(dataFromUser).map(function(key){ return {name: key, value: dataFromUser[key]}; }); }
Users will use myFunc directly, that is, they will pass any object that they want.
Ignoring how dataArr will be used, anyway, when at the point dataFromUser[key] is evaluated, are we vulnerable? Maybe the user can implement getter in a way that could harm us?
source share