Skip to content

Minimist throws on options like '--toString' '--constructor', '--_proto_' #47

Open
@user58823

Description

@user58823

With the following minimal script, similar to the example from the README.md:

#!/usr/bin/env node
console.dir(require('minimist')(process.argv.slice(2)));

Running the file with options like --toString, --hasOwnProperty, --constructor, --__proto__ etc. causes minimist (version 1.2.8) to throw this error:

[...]/node_modules/minimist/index.js:127
		(aliases[key] || []).forEach(function (x) {
		                     ^
TypeError: (aliases[key] || []).forEach is not a function
    at setArg ([...]/node_modules/minimist/index.js:127:24)
    at module.exports ([...]/node_modules/minimist/index.js:178:5)
    at Object.<anonymous> ([...]/minimist-test.js:2:32)
    [...]
Node.js v18.17.1

From a quick glance at the source, changing the line var aliases = {}; to var aliases = Object.create(null); makes it no longer throw, but still gives weird results:

$ ./minimist-test.js --expected test
{ _: [], expected: 'test' }
$ ./minimist-test.js --hasOwnProperty test
{ _: [ 'test' ], hasOwnProperty: '' }

I assume there are other objects that should have a null prototype somewhere (which would probably also help with the "prototype pollution" problems you seem to be having).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions