Add @elastic/safer-lodash-set as an alternative to lodash.set

.eslintignore

@@ -37,6 +37,7 @@ target
 /x-pack/legacy/plugins/maps/public/vendor/**
 
 # package overrides
+/packages/kbn-safer-lodash-set/lodash/*
 /packages/eslint-config-kibana
 /packages/kbn-interpreter/src/common/lib/grammar.js
 /packages/kbn-plugin-generator/sao_template/template
@@ -46,4 +47,3 @@ target
 /packages/kbn-ui-framework/dist
 /packages/kbn-ui-framework/doc_site/build
 /packages/kbn-ui-framework/generator-kui/*/templates/
-

.eslintrc.js

@@ -535,6 +535,126 @@ module.exports = {
       files: ['test/harden/*.js'],
       rules: allMochaRulesOff,
     },
+    {
+      files: ['**/*.{js,mjs,ts,tsx}'],
+      rules: {
+        'no-restricted-imports': [
+          2,
+          {
+            paths: [
+              {
+                name: 'lodash',
+                importNames: ['set', 'setWith'],
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash.set',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash.setwith',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/set',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/setWith',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/fp',
+                importNames: ['set', 'setWith', 'assoc', 'assocPath'],
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/fp/set',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/fp/setWith',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/fp/assoc',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/fp/assocPath',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+            ],
+          },
+        ],
+        'no-restricted-modules': [
+          2,
+          {
+            paths: [
+              {
+                name: 'lodash.set',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash.setwith',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/set',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+              {
+                name: 'lodash/setWith',
+                message: 'Please use @kbn/safer-lodash-set instead',
+              },
+            ],
+          },
+        ],
+        'no-restricted-properties': [
+          2,
+          {
+            object: 'lodash',
+            property: 'set',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: '_',
+            property: 'set',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: 'lodash',
+            property: 'setWith',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: '_',
+            property: 'setWith',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: 'lodash',
+            property: 'assoc',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: '_',
+            property: 'assoc',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: 'lodash',
+            property: 'assocPath',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            object: '_',
+            property: 'assocPath',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+        ],
+      },
+    },
 
     /**
      * APM overrides

package.json

@@ -132,6 +132,7 @@
     "@elastic/good": "8.1.1-kibana2",
     "@elastic/numeral": "2.4.0",
     "@elastic/request-crypto": "1.1.4",
+    "@kbn/safer-lodash-set": "0.0.0",
     "@elastic/ui-ace": "0.2.3",
     "@hapi/good-squeeze": "5.2.1",
     "@hapi/wreck": "^15.0.2",

packages/kbn-safer-lodash-set/.gitignore

@@ -0,0 +1,2 @@
+.tmp
+node_modules

packages/kbn-safer-lodash-set/.npmignore

@@ -0,0 +1,2 @@
+test.js
+scripts

packages/kbn-safer-lodash-set/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 Elasticsearch BV, JS Foundation, and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/kbn-safer-lodash-set/README.md

@@ -0,0 +1,95 @@
+# @kbn/safer-lodash-set
+
+This module adds protection against prototype pollution to the [`set`]
+and [`setWith`] functions from [Lodash] and are API compatible with
+Lodash v4.x.
+
+## Example Usage
+
+```js
+const { set } = require('@elastic/safer-loadsh-set');
+
+const object = { a: [{ b: { c: 3 } }] };
+
+set(object, 'a[0].b.c', 4);
+console.log(object.a[0].b.c); // => 4
+
+set(object, ['x', '0', 'y', 'z'], 5);
+console.log(object.x[0].y.z); // => 5
+```
+
+## API
+
+The main module exposes two functions, `set` and `setWith`:
+
+```js
+const { set, setWith } = require('@kbn/safer-lodash-set');
+```
+
+Besides the main module, it's also possible to require each function
+individually:
+
+```js
+const set = require('@kbn/safer-lodash-set/set');
+const setWith = require('@kbn/safer-lodash-set/setWith');
+```
+
+The APIs of these functions are identical to the equivalent Lodash
+[`set`] and [`setWith`] functions. Please refer to the Lodash
+documentation for the respective functions for details.
+
+## Limitations
+
+The safety improvements in this module is achived by adding the
+following limitations to the algorithm used to walk the `path` given as
+the 2nd argument to the `set` and `setWith` functions:
+
+### Only own properties are followed when walking the `path`
+
+```js
+const parent = { foo: 1 };
+const child = { bar: 2 };
+
+Object.setPrototypeOf(child, parent);
+
+// Now `child` can access `foo` through prototype inheritance
+console.log(child.foo); // 1
+
+set(child, 'foo', 3);
+
+// A different `foo` property has now been added directly to the `child`
+// object and the `parent` object has not been modified:
+console.log(child.foo); // 3
+console.log(parent.foo); // 1
+console.log(Object.prototype.hasOwnProperty.call(child, 'foo')); // true
+```
+
+### The `path` must not access function prototypes
+
+```js
+const object = {
+  fn1: function () {}, // regular functions has a prototype
+  fn2: () => {}, // arrow functions doesn't have a prototype
+};
+
+// Attempting to access any function prototype will result in an
+// exception being thrown:
+assert.throws(() => {
+  // Throws: Illegal access of function prototype
+  set(object, 'fn1.prototype.toString', 'bang!');
+});
+
+assert.doesNotThrow(() => {
+  // Will just create a fresh `prototype` property on the arrow function:
+  set(object, 'fn2.prototype.toString', 'bang!');
+  console.log(object.fn2); // '[Function: fn2] { prototype: { toString: 'bang!' } }'
+});
+```
+
+## License
+
+[MIT](LICENSE)
+
+[`set`]: https://lodash.com/docs/4.17.15#set
+[`setwith`]: https://lodash.com/docs/4.17.15#setWith
+[lodash]: https://lodash.com/

packages/kbn-safer-lodash-set/index.js

@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+exports.set = require('./lodash/set');
+exports.setWith = require('./lodash/setWith');

packages/kbn-safer-lodash-set/lodash/_Hash.js

@@ -0,0 +1,32 @@
+var hashClear = require('./_hashClear'),
+    hashDelete = require('./_hashDelete'),
+    hashGet = require('./_hashGet'),
+    hashHas = require('./_hashHas'),
+    hashSet = require('./_hashSet');
+
+/**
+ * Creates a hash object.
+ *
+ * @private
+ * @constructor
+ * @param {Array} [entries] The key-value pairs to cache.
+ */
+function Hash(entries) {
+  var index = -1,
+      length = entries == null ? 0 : entries.length;
+
+  this.clear();
+  while (++index < length) {
+    var entry = entries[index];
+    this.set(entry[0], entry[1]);
+  }
+}
+
+// Add methods to `Hash`.
+Hash.prototype.clear = hashClear;
+Hash.prototype['delete'] = hashDelete;
+Hash.prototype.get = hashGet;
+Hash.prototype.has = hashHas;
+Hash.prototype.set = hashSet;
+
+module.exports = Hash;

packages/kbn-safer-lodash-set/lodash/_ListCache.js

@@ -0,0 +1,32 @@
+var listCacheClear = require('./_listCacheClear'),
+    listCacheDelete = require('./_listCacheDelete'),
+    listCacheGet = require('./_listCacheGet'),
+    listCacheHas = require('./_listCacheHas'),
+    listCacheSet = require('./_listCacheSet');
+
+/**
+ * Creates an list cache object.
+ *
+ * @private
+ * @constructor
+ * @param {Array} [entries] The key-value pairs to cache.
+ */
+function ListCache(entries) {
+  var index = -1,
+      length = entries == null ? 0 : entries.length;
+
+  this.clear();
+  while (++index < length) {
+    var entry = entries[index];
+    this.set(entry[0], entry[1]);
+  }
+}
+
+// Add methods to `ListCache`.
+ListCache.prototype.clear = listCacheClear;
+ListCache.prototype['delete'] = listCacheDelete;
+ListCache.prototype.get = listCacheGet;
+ListCache.prototype.has = listCacheHas;
+ListCache.prototype.set = listCacheSet;
+
+module.exports = ListCache;

packages/kbn-safer-lodash-set/lodash/_Map.js

@@ -0,0 +1,7 @@
+var getNative = require('./_getNative'),
+    root = require('./_root');
+
+/* Built-in method references that are verified to be native. */
+var Map = getNative(root, 'Map');
+
+module.exports = Map;