{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/5642","repository_url":"https://api.github.com/repos/nodejs/node","labels_url":"https://api.github.com/repos/nodejs/node/issues/5642/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/5642/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/5642/events","html_url":"https://github.com/nodejs/node/issues/5642","id":139891962,"number":5642,"title":"querystring module swallows `__proto__` key","user":{"login":"WebReflection","id":85749,"avatar_url":"https://avatars.githubusercontent.com/u/85749?v=3","gravatar_id":"","url":"https://api.github.com/users/WebReflection","html_url":"https://github.com/WebReflection","followers_url":"https://api.github.com/users/WebReflection/followers","following_url":"https://api.github.com/users/WebReflection/following{/other_user}","gists_url":"https://api.github.com/users/WebReflection/gists{/gist_id}","starred_url":"https://api.github.com/users/WebReflection/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WebReflection/subscriptions","organizations_url":"https://api.github.com/users/WebReflection/orgs","repos_url":"https://api.github.com/users/WebReflection/repos","events_url":"https://api.github.com/users/WebReflection/events{/privacy}","received_events_url":"https://api.github.com/users/WebReflection/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/querystring","name":"querystring","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-03-10T13:53:25Z","updated_at":"2016-03-10T23:52:54Z","closed_at":null,"body":"If a URL contains `__proto__=123` that has no meaning for any other server out there and it's handled like a regular string.\r\n\r\nHowever, the querystring module swallows the key, probably trying to set the string `\"123\"` as returned object prototype.\r\n\r\nSince every other key is set as `{configurable: true, writable: true, enumerable: true, value: decodedValue}` I think in the very special `key in out && !hasOwnProperty.call(out, key)` case the returned `out` object should have properties set as such:\r\n\r\n```js\r\nObject.defineProperty(\r\n  out,\r\n  key,\r\n  {\r\n    configurable: true,\r\n    enumerable: true,\r\n    writable: true,\r\n    value: options.decodeURIComponent(value)\r\n});\r\n```\r\n\r\nThis would grant consistency with any sort of possible dangerous key inherited, as setter or getter, through the `Object.prototype`.\r\n\r\n\r\n* **Version**: v5.7.1\r\n* **Platform**: Linux archibold 4.4.3-1-ARCH #1 SMP PREEMPT Fri Feb 26 15:09:29 CET 2016 x86_64 GNU/Linux (it's just ArchLinux)\r\n* **Subsystem**: `querystring`\r\n\r\nBest Regards"},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/195106815","html_url":"https://github.com/nodejs/node/issues/5642#issuecomment-195106815","issue_url":"https://api.github.com/repos/nodejs/node/issues/5642","id":195106815,"user":{"login":"WebReflection","id":85749,"avatar_url":"https://avatars.githubusercontent.com/u/85749?v=3","gravatar_id":"","url":"https://api.github.com/users/WebReflection","html_url":"https://github.com/WebReflection","followers_url":"https://api.github.com/users/WebReflection/followers","following_url":"https://api.github.com/users/WebReflection/following{/other_user}","gists_url":"https://api.github.com/users/WebReflection/gists{/gist_id}","starred_url":"https://api.github.com/users/WebReflection/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WebReflection/subscriptions","organizations_url":"https://api.github.com/users/WebReflection/orgs","repos_url":"https://api.github.com/users/WebReflection/repos","events_url":"https://api.github.com/users/WebReflection/events{/privacy}","received_events_url":"https://api.github.com/users/WebReflection/received_events","type":"User","site_admin":false},"created_at":"2016-03-10T23:52:54Z","updated_at":"2016-03-10T23:52:54Z","body":"midnight here, so I won't probably answer any other question but you can check the PR I've just pushed and verified via the test suite provided by this repo.\r\n\r\nHope it's clear what I meant when I've said `key in obj` is the red herring you want to eventually double check without trusting own keys array only."}}