diff --git a/test/suites/pollution.js b/test/suites/pollution.js index 2bca8dd..bf47756 100644 --- a/test/suites/pollution.js +++ b/test/suites/pollution.js @@ -85,5 +85,15 @@ export default function (dset) { }); }); + // Test for CVE-2022-25645 - CWE-1321 + pollution('should ignore JSON.parse crafted object with "__proto__" key', () => { + let a = { b: { c: 1 } }; + assert.is(a.polluted, undefined); + assert.is({}.polluted, undefined); + dset(a, "b", JSON.parse('{"__proto__":{"polluted":"Yes!"}}')); + assert.is(a.polluted, undefined); + assert.is({}.polluted, undefined); + }); + pollution.run(); }