Skip to content

Commit 951fcc8

Browse files
authored
docs: Correct typos
Fixes #110
1 parent 64ae529 commit 951fcc8

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

docs/the-dangers-of-square-bracket-notation.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Let's take a look at why this could be a problem.
1111
## Issue #1: Bracket object notation with user input grants access to every property available on the object
1212

1313
```js
14-
exampleClass[userInput[1]] = userInput[2];
14+
exampleClass[userInput[0]] = userInput[1];
1515
```
1616

1717
I won't spend much time here, as I believe this is fairly well known. If exampleClass contains a sensitive property, the above code will allow it to be edited.
@@ -20,7 +20,7 @@ I won't spend much time here, as I believe this is fairly well known. If example
2020

2121
```js
2222
userInput = ['constructor', '{}'];
23-
exampleClass[userInput[1]] = userInput[2];
23+
exampleClass[userInput[0]] = userInput[1];
2424
```
2525

2626
This looks pretty innocuous, even if it is an uncommon pattern. The problem here is that we can access or overwrite prototypes such as `constructor` or `__defineGetter__`, which may be used later on. The most likely outcome of this scenario would be an application crash, when a string is attempted to be called as a function.

0 commit comments

Comments
 (0)