Open
Description
With the following minimal script, similar to the example from the README.md:
#!/usr/bin/env node
console.dir(require('minimist')(process.argv.slice(2)));
Running the file with options like --toString
, --hasOwnProperty
, --constructor
, --__proto__
etc. causes minimist (version 1.2.8) to throw this error:
[...]/node_modules/minimist/index.js:127
(aliases[key] || []).forEach(function (x) {
^
TypeError: (aliases[key] || []).forEach is not a function
at setArg ([...]/node_modules/minimist/index.js:127:24)
at module.exports ([...]/node_modules/minimist/index.js:178:5)
at Object.<anonymous> ([...]/minimist-test.js:2:32)
[...]
Node.js v18.17.1
From a quick glance at the source, changing the line var aliases = {};
to var aliases = Object.create(null);
makes it no longer throw, but still gives weird results:
$ ./minimist-test.js --expected test
{ _: [], expected: 'test' }
$ ./minimist-test.js --hasOwnProperty test
{ _: [ 'test' ], hasOwnProperty: '' }
I assume there are other objects that should have a null prototype somewhere (which would probably also help with the "prototype pollution" problems you seem to be having).
Metadata
Metadata
Assignees
Labels
No labels