REJECTED (not a vulnerability): improperly controlled modification of query properties in express (original) (raw)
Caution
This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.
Caution
This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.
Caution
This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.
Withdrawn advisory
This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references.
Original description
Impact
when using the extended query parser in express ('query parser': 'extended'), the request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names
Important
the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser
Patches
the issue has been patched to ensure request.query is a plain object so request.query no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser
Workaround
this only impacts users using extended query parsing ('query parser': 'extended'), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue:
provide qs directly and specify plainObjects: true
app.set('query parser', function (str) { return qs.parse(str, { plainObjects: true }); });