fix: prevent prototype pollution in MO/PO parsers and headers

Author: smhg

lib/moparser.js

@@ -163,11 +163,11 @@ Parser.prototype._addString = function (msgid, msgstr) {
   msgstr = msgstr.split('\u0000');
   translation.msgstr = [].concat(msgstr || []);
 
-  if (!this._table.translations[msgctxt]) {
-    this._table.translations[msgctxt] = {};
+  if (!Object.hasOwn(this._table.translations, msgctxt)) {
+    Object.defineProperty(this._table.translations, msgctxt, { value: {}, writable: true, enumerable: true, configurable: true });
   }
 
-  this._table.translations[msgctxt][msgid] = translation;
+  Object.defineProperty(this._table.translations[msgctxt], msgid, { value: translation, writable: true, enumerable: true, configurable: true });
 };
 
 /**

lib/poparser.js

@@ -464,19 +464,19 @@ Parser.prototype._normalize = function (tokens) {
         table.obsolete = {};
       }
 
-      if (!table.obsolete[msgctxt]) {
-        table.obsolete[msgctxt] = {};
+      if (!Object.hasOwn(table.obsolete, msgctxt)) {
+        Object.defineProperty(table.obsolete, msgctxt, { value: {}, writable: true, enumerable: true, configurable: true });
       }
 
       delete tokens[i].obsolete;
 
-      table.obsolete[msgctxt][tokens[i].msgid] = tokens[i];
+      Object.defineProperty(table.obsolete[msgctxt], tokens[i].msgid, { value: tokens[i], writable: true, enumerable: true, configurable: true });
 
       continue;
     }
 
-    if (!table.translations[msgctxt]) {
-      table.translations[msgctxt] = {};
+    if (!Object.hasOwn(table.translations, msgctxt)) {
+      Object.defineProperty(table.translations, msgctxt, { value: {}, writable: true, enumerable: true, configurable: true });
     }
 
     if (!table.headers && !msgctxt && !tokens[i].msgid) {
@@ -486,7 +486,7 @@ Parser.prototype._normalize = function (tokens) {
 
     this._validateToken(tokens[i], table.translations, msgctxt, nplurals);
 
-    table.translations[msgctxt][tokens[i].msgid] = tokens[i];
+    Object.defineProperty(table.translations[msgctxt], tokens[i].msgid, { value: tokens[i], writable: true, enumerable: true, configurable: true });
   }
 
   return table;

lib/shared.js

@@ -32,7 +32,7 @@ export function parseHeader (str = '') {
 
         key = HEADERS.get(key.toLowerCase()) || key;
 
-        headers[key] = value;
+        Object.defineProperty(headers, key, { value, writable: true, enumerable: true, configurable: true });
       }
 
       return headers;

test/po-parser-test.js

@@ -240,4 +240,15 @@ describe('PO Parser', () => {
       });
     });
   });
+
+  describe('prototype pollution', () => {
+    it('should not pollute Object.prototype via msgctxt', () => {
+      const po = 'msgctxt "__proto__"\nmsgid "polluted"\nmsgstr "yes"\n';
+
+      gettextParser.po.parse(po);
+
+      assert.strictEqual({}.polluted, undefined, 'Object.prototype should not be polluted');
+      assert.strictEqual(({}).polluted, undefined, 'Object.prototype should not be polluted');
+    });
+  });
 });