chore(config): guard against prototype pollution

NicTool · Feb 28, 2024 · ef7aeba · ef7aeba
1 parent 93cb6eb
commit ef7aeba
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/lib/config.js b/lib/config.js
@@ -48,6 +48,7 @@ class Config {
 
 function applyDefaults(cfg = {}, defaults = {}) {
   for (const d in defaults) {
+    if (d === "__proto__" || d === "constructor") continue;
     if ([undefined, null].includes(cfg[d])) {
       cfg[d] = defaults[d]
     } else if (typeof cfg[d] === 'object' && typeof defaults[d] === 'object') {

diff --git a/routes/index.js b/routes/index.js
@@ -57,10 +57,8 @@ async function setup() {
     },
   ])
 
-  const sessionCfg = await Config.get('session')
-
   server.auth.strategy('session', 'cookie', {
-    cookie: sessionCfg.cookie,
+    cookie: httpCfg.cookie,
 
     validate: async (request, session) => {
       const s = await Session.get({ id: session.nt_user_session_id })