The Core Vulnerability#

At its core, the vulnerability exists in the library’s attribute assignment logic. Linkify.js uses a custom assign() helper function that naively copies properties without proper validation:

1
export default function assign(target, properties) {
2
  for (const key in properties) {
3
    target[key] = properties[key];  // Prototype pollution vector
4
  }
5
  return target;
6
}

Prototype Pollution Mechanics#

When processing link attributes, the library accepts user-controlled input through the options.attributes object. By providing a specially crafted object with a __proto__ property, an attacker can pollute the prototype of the base Object:

1
const maliciousOptions = {
2
  attributes: {
3
    __proto__: {
4
      // These properties will be inherited by all objects
5
      onclick: 'alert("XSS")',
6
      onmouseover: 'alert("XSS")',
7
      // ... other malicious attributes
8
    }
9
  }
10
};

The DOM XSS Chain#

1. Initialization Phase:

   • Application initializes Linkify with user-controlled options
   • Malicious attributes are merged into the prototype chain

2. DOM Injection:

   • When links are rendered, they inherit the polluted prototype
   • Event handlers are automatically bound through the prototype chain
   • No direct assignment of malicious code is visible in the DOM

Advanced Exploitation Vectors#

1
// Backend API handler (vulnerable)
2
app.post('/api/comment', (req, res) => {
3
  const { content } = req.body;
4
  // Process content with vulnerable Linkify version
5
  const processed = linkifyHtml(content, req.user.preferences);
6
  saveToDatabase(processed);  // Stored XSS
7
});

1
// Client-side rendering (vulnerable)
2
const params = new URLSearchParams(window.location.search);
3
const userContent = params.get('search');
4
document.body.innerHTML = linkifyHtml(userContent);

Bypassing Traditional Protections#

1. Content Security Policy (CSP):

   • Many CSP implementations allow 'unsafe-inline' for event handlers
   • Even with strict CSP, javascript: URIs might be allowed for navigation

2. Input Sanitization:

   • Most HTML sanitizers don’t catch prototype pollution
   • The attack happens at the JavaScript level, not in the HTML

Immediate Actions#

1. Upgrade to Linkify.js 4.3.2+

   1
   npm install linkifyjs@latest
   

2. Temporary Workarounds

   1
   // Safe wrapper function
   2
   function safeLinkify(text, options = {}) {
   3
     // Remove __proto__ and constructor from options
   4
     const safeOptions = JSON.parse(JSON.stringify(options));
   5
     return linkifyHtml(text, safeOptions);
   6
   }
   

Secure Implementation Patterns#

1. Input Validation

   1
   function validateAttributes(attrs) {
   2
     const safeAttrs = {};
   3
     const ALLOWED_ATTRS = ['class', 'target', 'rel', 'title'];
   4
   
   5
     for (const [key, value] of Object.entries(attrs)) {
   6
       if (ALLOWED_ATTRS.includes(key)) {
   7
         safeAttrs[key] = value;
   8
       }
   9
     }
   10
     return safeAttrs;
   11
   }
   

2. Deep Object Freezing

   Object.freeze() is a powerful JavaScript method that prevents modifications to an object. When applied, it:

   • Makes the object immutable (can’t add, remove, or modify properties)
   • Prevents changes to property descriptors
   • Makes the object’s prototype immutable

   1
   // Basic usage
   2
   const config = { apiKey: '123' };
   3
   Object.freeze(config);
   4
   
   5
   config.apiKey = 'hacked'; // Fails silently in non-strict mode
   6
   delete config.apiKey;     // Fails
   7
   config.newProp = 'test';  // Fails
   

   For nested objects, we need a recursive solution:

   1
   function deepFreeze(object) {
   2
     // Freeze the object itself
   3
     Object.freeze(object);
   4
   
   5
     // Handle null/undefined and non-objects
   6
     if (object === null || typeof object !== 'object') {
   7
       return object;
   8
     }
   9
   
   10
     // Freeze all properties
   11
     Object.getOwnPropertyNames(object).forEach(prop => {
   12
       const value = object[prop];
   13
       // Recursively freeze objects and functions, but skip already frozen objects
   14
       if (!Object.isFrozen(value) && (value instanceof Object)) {
   15
         deepFreeze(value);
   16
       }
   17
     });
   18
   
   19
     return object;
   20
   }
   21
   
   22
   // Usage in Linkify.js context
   23
   const safeOptions = deepFreeze({
   24
     attributes: {
   25
       // ... your attributes
   26
     }
   27
   });
   

   This pattern is particularly effective against prototype pollution because:

   1. It prevents modifications to the prototype chain
   2. It makes the object’s structure immutable
   3. It fails loudly in strict mode when someone tries to modify it

   For more in-depth information, refer to the MDN documentation on Object.freeze().

   Important Note: While Object.freeze() is powerful, it only provides shallow immutability by default. Always use deep freezing for complex objects to ensure complete protection.

Identifying Vulnerable Implementations#

1
// Detection script
2
const isVulnerable = (() => {
3
  try {
4
    const test = {};
5
    linkifyHtml('test', {
6
      attributes: {
7
        __proto__: { test: 1 }
8
      }
9
    });
10
    return ({}).test === 1;
11
  } catch (e) {
12
    return false;
13
  }
14
})();

Log Analysis Patterns#

Look for suspicious patterns in logs:

• Unusual __proto__ properties in attribute objects
• Unexpected event handlers in linkify operations
• Multiple failed attempts with different attribute combinations