Prototype Pollution via _proto_/constructor in Graph Layout Cycle Detection

Vulnerability Overview This vulnerability involves the use of a for lookups and cycle checks when locating node IDs within a tree layout. The issue arises when node names are or ; these names are silently removed from the layout or parsing process, causing them to resolve to inherited functions. Additionally, edges whose source is not in the node set are protected, and the maximum depth is accumulated rather than adding each level to . Impact Scope Affected Files: and Specific Impacts: - In , the function may fail to detect cycles due to node names being or when processing nodes and edges. - In , multiple methods in the class may cause layout errors or performance issues due to the aforementioned problem when processing nodes and edges. Fix Strategy 1. : - Modify the function to correctly handle cases where node names are or when processing nodes and edges. - Use a instead of a plain object to store nodes and edges to avoid interference from properties on the prototype chain. 2. : - Modify the relevant methods in the class to correctly handle cases where node names are or when processing nodes and edges. - Use a instead of a plain object to store nodes and edges to avoid interference from properties on the prototype chain. - Protect edges whose source is not in the node set, and accumulate the maximum depth rather than adding each level to . Code Changes ```typescript export class TreeLayout { protected levels: Map = new Map(); constructor() { this.positionedNodesById = new Map(); this.levels = new Map(); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (const node of nodes) { adj.set(node.id, []); } for (const { source, target } of edges) { adj.get(source.id)?.push(target.id); } // ... const levels = new Map(); const adj = new Map(); for (cons

Goal Reached Thanks to every supporter — we hit 100%!

Prototype Pollution via _proto_/constructor in Graph Layout Cycle Detection

More from this source