原型链污染2

还是没时间看

{
  "contact":"a", "reason":"a",
  "constructor":{
    "prototype":{
      "format": "yy19-MM-ddTHH:mm:ss.fffZ",
      "baseDate":"aaa",
      "fff": "bbb"
    }
  }
}

routes/_components/utils.js里是merge

const DEFAULT_CREATE_DATE_OPTIONS = {
    UTC: false,
    format: [
        "yyyy-MM-dd HH:mm:ss",
        "yyyy-MM-dd HH:mm:ss.fff",
        "yyyy-MM-dd",
        "MM/dd/yyyy",
        "MM/dd/yyyy HH:mm:ss",
        "MM/dd/yyyy HH:mm:ss.fff",
        "MM/dd/yy HH:mm:ss",
        "HH:mm:ss",
        "HH:mm:ss.fff"
    ],
    // baseDate: undefined
}

const CopiedDefaultOptions = copyJSON(DEFAULT_CREATE_DATE_OPTIONS)
if (typeof opts === "undefined") opts = CopiedDefaultOptions
if (typeof opts !== "object") opts = { ...CopiedDefaultOptions, UTC: Boolean(opts) };
opts.UTC = typeof opts.UTC === "undefined" ? CopiedDefaultOptions.UTC : Boolean(opts.UTC);
opts.format = opts.format || CopiedDefaultOptions.format;
if (!Array.isArray(opts.format)) opts.format = [opts.format]
opts.format = opts.format.filter(f => typeof f === "string")
  .filter(f => {
    if (/yy|yyyy|MM|dd|HH|mm|ss|fff/.test(f) === false) {
      console.warn(`Invalid format "${f}".`, `At least one format specifier is required.`);
      return false;
    }
    if (`|${f}|`.replace(/yyyy/g, "yy").split(/yy|MM|dd|HH|mm|ss|fff/).includes("")) {
      console.warn(`Invalid format "${f}".`, `Delimeters are required between format specifiers.`);
      return false;
    }
    if (f.includes("yyyy") && f.replace(/yyyy/g, "").includes("yy")) {
      console.warn(`Invalid format "${f}".`, `"yyyy" and "yy" cannot be used together.`);
      return false;
    }
    return true;
  })
opts.baseDate = new Date(opts.baseDate || Date.now());

当createDate的opts未指定时并不能注入，但是当opts为 JSON 对象且没有指定format属性时，下面这一行会触发原型链

opts.format = opts.format || CopiedDefaultOptions.format;

而对于baseDate，由于DEFAULT_CREATE_DATE_OPTIONS中本身不含baseDate，可直接触发该原型链

opts.baseDate = new Date(opts.baseDate || Date.now());

不看了,太长了

here