fix: IdentitiesManager.putToken now uses Object.definePriority to…

… avoid serialisation issues when the `identityId` is `__proto__`
MatrixAI · Oct 26, 2023 · 8142056 · 8142056
1 parent 9e1e869
commit 8142056
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/identities/IdentitiesManager.ts b/src/identities/IdentitiesManager.ts
@@ -206,7 +206,15 @@ class IdentitiesManager {
       );
     }
     const providerTokens = await this.getTokens(providerId);
-    providerTokens[identityId] = providerToken;
+    // This has to be done in case the key is `__proto__`.
+    // Otherwise, the object will not be correctly serialized.
+    // https://github.com/MatrixAI/Polykey/issues/608
+    Object.defineProperty(providerTokens, identityId, {
+      value: providerToken,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
     const providerIdPath = [
       ...this.identitiesTokensDbPath,
       providerId,