Skip to content

[fix] 블록 prototype pollution 기반 Stored XSS 취약점 차단 #3073

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Tnks2U merged 1 commit into from
Jun 2, 2026
Merged

[fix] 블록 prototype pollution 기반 Stored XSS 취약점 차단 #3073

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@
"jest": "^24.9.0",
"khaiii": "^0.0.2",
"libsvm-js": "^0.2.1",
"lodash": "^4.17.15",
"lodash": "^4.17.21",
"mathjs": "^7.1.0",
"ml-cart": "^2.1.1",
"pixi.js": "5.3.12",
Expand Down
2 changes: 1 addition & 1 deletion pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

34 changes: 29 additions & 5 deletions src/playground/blocks/hardware/block_KKMOO.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -653,15 +653,23 @@ Entry.kkmoo.getBlocks = function () {
func: function (sprite, script) {
const motnum = script.getField('MOTNUM', script);
const angle = script.getValue('ANGLE', script);
const index = Number(motnum);
if (
!Number.isInteger(index) ||
index < 0 ||
index >= Entry.kkmoo.motData.length
) {
return script.callReturn();
}
Entry.hw.update();
if (script.isStart != true) {
script.isStart = true;
if (angle >= -90 && angle <= 90) {
Entry.kkmoo.motData[motnum].angle = angle;
Entry.kkmoo.motData[index].angle = angle;
} else if (angle > 90) {
Entry.kkmoo.motData[motnum].angle = 90;
Entry.kkmoo.motData[index].angle = 90;
} else {
Entry.kkmoo.motData[motnum].angle = -90;
Entry.kkmoo.motData[index].angle = -90;
}
return script;
} else {
Expand Down Expand Up @@ -854,11 +862,19 @@ Entry.kkmoo.getBlocks = function () {
isNotFor: ['kkmoo'],
func: function (sprite, script) {
const motnum = script.getField('FRAME', script);
const index = Number(motnum);
if (
!Number.isInteger(index) ||
index < 0 ||
index >= Entry.kkmoo.motionFrame.length
) {
return script.callReturn();
}
Entry.hw.update();
if (script.isStart != true) {
script.isStart = true;
var data = Entry.kkmoo.copyObj(Entry.kkmoo.motData);
Entry.kkmoo.motionFrame[motnum].data = data;
Entry.kkmoo.motionFrame[index].data = data;
return script;
} else {
delete script.isStart;
Expand Down Expand Up @@ -974,10 +990,18 @@ Entry.kkmoo.getBlocks = function () {
func: function (sprite, script) {
const motnum = script.getField('FRAME', script);
const time = script.getValue('TIME', script);
const index = Number(motnum);
if (
!Number.isInteger(index) ||
index < 0 ||
index >= Entry.kkmoo.motionFrame.length
) {
return script.callReturn();
}
Entry.hw.update();
if (script.isStart != true) {
script.isStart = true;
Entry.kkmoo.motionFrame[motnum].time = time;
Entry.kkmoo.motionFrame[index].time = time;
return script;
} else {
delete script.isStart;
Expand Down
8 changes: 1 addition & 7 deletions src/playground/blocks/hardware/block_armz.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,5 @@
'use strict';

const _set = require('lodash/set');
const _get = require('lodash/get');
const _merge = require('lodash/merge');

Entry.Armz = new class Armz {
constructor() {
// this.id = 'FF.FF';
Expand Down Expand Up @@ -104,9 +100,7 @@ Entry.Armz = new class Armz {

postSendQueue({ script, data }, scope) {
const blockId = this.getHashKey();
_merge(Entry.hw.sendQueue, {
[blockId]: data,
});
Entry.hw.sendQueue[blockId] = data;
}

postCallReturn(args) {
Expand Down
4 changes: 1 addition & 3 deletions src/playground/blocks/hardware/block_asomebot.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,7 @@ Entry.AsomeBot = {
scope.timeFlag = 1;
this.nowBlockId = blockId;
this.blockIds[blockId] = false;
_merge(Entry.hw.sendQueue, {
[blockId]: data,
});
Entry.hw.sendQueue[blockId] = data;
Entry.hw.update();
setTimeout(() => {
scope.timeFlag = 0;
Expand Down
4 changes: 1 addition & 3 deletions src/playground/blocks/hardware/block_asomekit.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,7 @@ Entry.AsomeKit = {
scope.timeFlag = 1;
this.nowBlockId = blockId;
this.blockIds[blockId] = false;
_merge(Entry.hw.sendQueue, {
[blockId]: data,
});
Entry.hw.sendQueue[blockId] = data;
Entry.hw.update();
setTimeout(() => {
scope.timeFlag = 0;
Expand Down
5 changes: 1 addition & 4 deletions src/playground/blocks/hardware/block_davinci.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

const _set = require('lodash/set');
const _get = require('lodash/get');
const _merge = require('lodash/merge');

Entry.Davinci = new class Davinci {
constructor() {
Expand Down Expand Up @@ -73,9 +72,7 @@ Entry.Davinci = new class Davinci {
scope.timeFlag = 1;
this.nowBlockId = blockId;
this.blockIds[blockId] = false;
_merge(Entry.hw.sendQueue, {
[blockId]: data,
});
Entry.hw.sendQueue[blockId] = data;
Entry.hw.update();
setTimeout(() => {
scope.timeFlag = 0;
Expand Down
5 changes: 1 addition & 4 deletions src/playground/blocks/hardware/block_microbit.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

const _set = require('lodash/set');
const _get = require('lodash/get');
const _merge = require('lodash/merge');

Entry.Microbit = new (class Microbit {
constructor() {
Expand Down Expand Up @@ -73,9 +72,7 @@ Entry.Microbit = new (class Microbit {
scope.timeFlag = 1;
this.nowBlockId = blockId;
this.blockIds[blockId] = false;
_merge(Entry.hw.sendQueue, {
[blockId]: data,
});
Entry.hw.sendQueue[blockId] = data;
Entry.hw.update();
setTimeout(() => {
scope.timeFlag = 0;
Expand Down
5 changes: 4 additions & 1 deletion src/playground/scope.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,10 @@ class Scope {
static _reservedKeywords = new Set(['__proto__']);

filterReservedKeywords(param) {
return Scope._reservedKeywords.has(param) ? '' : param;
// 배열/객체를 키로 쓸 때 toString 변환(예: ["__proto__"] → "__proto__")으로
// 예약어를 우회하는 것을 차단한다.
const normalized = typeof param === 'object' && param !== null ? String(param) : param;
return Scope._reservedKeywords.has(normalized) ? '' : param;
}

getParams() {
Expand Down
Loading