Control: tag -1 = trixie confirmed On Fri, Jul 24, 2026 at 06:58:09PM +0530, Utkarsh Gupta wrote: > Hi Jonathan, > > On Wed, Jul 15, 2026 at 1:25 AM Jonathan Wiltshire <[email protected]> wrote: > > JavaScript is not my forte, so I may be up the wrong tree here. But in: > > > > | if (key === '__proto__' && > > | !hasOwnProperty.call(object, '__proto__')) { > > | return false; > > } > > > > Could it be that `object` here is always the original object, rather than > > the object at the current point in the path, allowing a later `__proto__` > > to slip through? > > Interesting point. I was able to probably reproduce what you're > saying. "object" in that guard is the original root object, it's never > advanced as the loop walks the path. The hole is specific to __proto__ > when the root carries an own __proto__ key. So only the __proto__ > guard is affected and the impact is deletion, not assignment. > > Note this is upstream's code as shipped in 4.18.0 (commit fe8d32e), so > it looks like a residual flaw in the upstream fix itself. I'll report > it upstream: the proper correction is to check ownership against the > current node during traversal rather than the root, I think?
Yes, if we're right about the issue that sounds the appropriate fix. But I agree this is better handled upstream. I'll take the current fixes in case upstream is not responsive in time before the point release, even though it's a while away yet. Thanks, -- Jonathan Wiltshire [email protected] Debian Developer http://people.debian.org/~jmw 4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51 ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
