From 8441d2139ce1646c0cfe0282eea83f00a381f79e Mon Sep 17 00:00:00 2001
From: Tsvetomir Tsonev <cvetomirconev@gmail.com>
Date: Tue, 17 Aug 2021 11:34:10 +0300
Subject: [PATCH] fix: use a null prototype object for this.files

---
 lib/main.js            |   8 ++++----
 test/asserts/load.js   |  13 +++++++++++++
 test/ref/pollution.zip | Bin 0 -> 480 bytes
 3 files changed, 17 insertions(+), 4 deletions(-)
 create mode 100644 test/ref/pollution.zip

diff --git a/lib/main.js b/lib/main.js
index 963a5e5..3dfa9f2 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -175,7 +175,10 @@ class JSZip {
         //   "folder/" : {...},
         //   "folder/data.txt" : {...}
         // }
-        this.files = {};
+        // NOTE: we use a null prototype because we do not
+        // want filenames like "toString" coming from a zip file
+        // to overwrite methods and attributes in a normal Object.
+        this.files = Object.create(null);
 
         this.comment = null;
 
@@ -208,9 +211,6 @@ class JSZip {
     forEach(cb) {
         var filename, relativePath, file;
         for (filename in this.files) {
-            if (!this.files.hasOwnProperty(filename)) {
-                continue;
-            }
             file = this.files[filename];
             relativePath = filename.slice(this.root.length, filename.length);
             if (relativePath && filename.slice(0, this.root.length) === this.root) { // the file is in the current root
diff --git a/test/asserts/load.js b/test/asserts/load.js
index 5b22966..669f1e1 100644
--- a/test/asserts/load.js
+++ b/test/asserts/load.js
@@ -17,6 +17,19 @@ QUnit.module("load", function () {
         })['catch'](JSZipTestUtils.assertNoError);
     });
 
+    JSZipTestUtils.testZipFile("Load files which shadow Object prototype methods", "ref/pollution.zip", function(assert, file) {
+        var done = assert.async();
+        assert.ok(typeof file === "string");
+        JSZip.loadAsync(file)
+        .then(function (zip) {
+            assert.notEqual(Object.getPrototypeOf(zip.files), zip.files.__proto__);
+            return zip.file("__proto__").async("string");        })
+        .then(function(result) {
+            assert.equal(result, "hello\n", "the zip was correctly read.");
+            done();
+        })['catch'](JSZipTestUtils.assertNoError);
+    });
+
     JSZipTestUtils.testZipFile("load(string) handles bytes > 255", "ref/all.zip", function(assert, file) {
         var done = assert.async();
         // the method used to load zip with ajax will remove the extra bits.
diff --git a/test/ref/pollution.zip b/test/ref/pollution.zip
new file mode 100644
index 0000000000000000000000000000000000000000..c673c0a0aadaddb43a88460c871aad0f41d206f3
GIT binary patch
literal 480
zcmWIWW@h1H0D-8yb3qCQR%UEKHVAVt$S{=T2bUCO=B0;*a56Bj2{@hr!lf1542&!<
zm>C#YQh@3*Qgd?hxdPzkB%+za2{b1@zMv?-BtJeLY|vJqA=?NWRE}m4H_)Ku{Ji3l
zqSEA&{35VX4}r!!!fg~IlN>WH-$?-7&cMJ3#7i1MEQDWKA$~>kXMi`tG)zAto8|#D
s4avtq<3K*fV;rVWk&T-OG!DhzKm$Sk#xRf-6m1O5K==+w-vMzL06Aq~cmMzZ

literal 0
HcmV?d00001