Skip to content

Commit 0ba0b11

Browse files
committed
Remove 'defineProperty' from blocklist
1 parent af0b33f commit 0ba0b11

File tree

1 file changed

+4
-8
lines changed
  • packages/controller-utils/src

1 file changed

+4
-8
lines changed

packages/controller-utils/src/util.ts

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,14 @@ import { MAX_SAFE_CHAIN_ID } from './constants';
1616

1717
const TIMEOUT_ERROR = new Error('timeout');
1818

19-
const PROTOTYPE_POLLUTION_BLOCKLIST = [
20-
'__proto__',
21-
'constructor',
22-
'defineProperty',
23-
] as const;
19+
const PROTOTYPE_POLLUTION_BLOCKLIST = ['__proto__', 'constructor'] as const;
2420

2521
/**
26-
* Checks whether a dynamic string used as an object key is a dangerous string
27-
* that makes the object vulnerable to a prototype pollution attack.
22+
* Checks whether a dynamic string used as an object property key
23+
* could be used in a prototype pollution attack.
2824
*
2925
* @param key - The dynamic key to check for safety.
30-
* @returns Whether the given dyanmic key is safe
26+
* @returns Whether the given dyanmic key is safe to use.
3127
*/
3228
export function isSafeDynamicKey(key: string): boolean {
3329
return PROTOTYPE_POLLUTION_BLOCKLIST.every((badInput) => key !== badInput);

0 commit comments

Comments
 (0)