fix: replace vulnerable merge function of predefine package with not vulnerable lodash.merge implementation

[Kirill89]

• Ready for review
• Follows CONTRIBUTING rules

What does this PR do?

According to Snyk broker has a Prototype Pollution vulnerability in predefine package introduced via primus@6.1.0 › fusing@1.0.0 › predefine@0.1.2. Together with @ohad2712 we verified that no user input flows to the vulnerable function merge directly or indirectly. To be precise, we observed some user input flows to merge but only of type String – which makes it not exploitable.

To make double sure we decided to replace vulnerable implementation of the merge function with similar function lodash.merge, which is not vulnerable.

To replace the function we require predefine package as early as possible and replace the function by directly overwriting it.

Where should the reviewer start?

lib/index.js

How should this be manually tested?

Any background context you want to provide?

https://snyk.io/vuln/SNYK-JS-PREDEFINE-1054935

predefine:

Vulnerable code: https://github.com/bigpipe/predefine/blob/0.1.2/index.js#L263-L294

PoC:

const predefine = require('predefine');
predefine.merge({}, JSON.parse('{"__proto__": {"a": "b"}}'));

console.log(({}).a === 'b' ? 'exploitable' : 'unexploitable'); // exploitable

Merge function is not used anywhere inside the package itself, but exported as part of the API.

fusing:

Vulnerable code: https://github.com/bigpipe/fusing/blob/1.0/index.js#L140

merge function is not used anywhere inside fusing package as well, but re-exported as part of prototype for each class.

primus:

• merge function is used in createServer function as 3d argument.
• merge function is used in transformers/engine.io/client.js but the only user input seems to be the url property.

[CLAassistant]

All committers have signed the CLA.

[snyksec]

🎉 This PR is included in version 4.109.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[Kirill89]

Please delete this workaround when bigpipe/predefine#12 is merged.