From 284fbb169c543b0858f757137d521bc75a80c358 Mon Sep 17 00:00:00 2001
From: Alexandru Cuciureanu <alexandru.cuciureanu@gmail.com>
Date: Wed, 8 Feb 2023 20:58:40 +0200
Subject: [PATCH] feat(enhanced the prototype pollution detection mecanism):
 better checking for prototype pollution

---
 sandbox/index.html          |  4 ++--
 sandbox/js/check.payload.js | 31 ++++++++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/sandbox/index.html b/sandbox/index.html
index 1d4b602..c2c236d 100644
--- a/sandbox/index.html
+++ b/sandbox/index.html
@@ -21,12 +21,12 @@
             types.reduce((acc, type) => intersectProtoPropNameReducer(acc, type, prev, curr), {});
     </script>
 
+    <script id="target"></script>
+
     <script>
         const before = prototypePropertyNames();
     </script>
 
-    <script id="target"></script>
-
     <script>
         const after = prototypePropertyNames();
 
diff --git a/sandbox/js/check.payload.js b/sandbox/js/check.payload.js
index af3776f..1391814 100644
--- a/sandbox/js/check.payload.js
+++ b/sandbox/js/check.payload.js
@@ -7,12 +7,41 @@ const prototypesPropertiesReducer = (acc, type) => ({
 
 const prototypePropertyNames = types.reduce(prototypesPropertiesReducer, {});
 
+// This function checks if a prototype property is polluted by changing its value
+// and checking if the value has changed. It returns a boolean indicating if the
+// property is polluted.
+const checkIfPrototypePropertyIsPolluted = (object, prop) => {
+  // Get the original value of the prototype property
+  const originalValue = Object.getOwnPropertyDescriptor(object, prop);
+  try {
+    // Change the value of the prototype property
+    object[prop] = 'polluted';
+    // If the value of the prototype property is 'polluted', it is polluted
+    if (object[prop] === 'polluted') {
+      return true;
+    }
+  } catch (e) {
+    // The property is read-only, so it is not polluted.
+    return false;
+  } finally {
+    // Restore the original value of the prototype property
+    Object.defineProperty(object, prop, originalValue);
+  }
+  return false;
+};
+
+// This function probes for polluted prototype properties and returns an array
+// of the names of the polluted properties.
 const probe = () =>
     Object.keys(prototypePropertyNames).reduce((acc, key) => {
         for (let propKey of prototypePropertyNames[key]) {
+            // Get the prototype property using eval()
             const payload = `${key}.prototype.${propKey}`;
             try {
-                if (typeof eval(payload) === 'function' && eval(payload).call() === window) {
+                const prop = eval(payload);
+                // If the prototype property is a function and its prototype is polluted,
+                // add its name to the result array.
+                if (typeof prop === 'function' && checkIfPrototypePropertyIsPolluted(prop.prototype, propKey)) {
                     acc.push(payload);
                 }
             } catch (e) {