[Pkg-javascript-devel] Bug#1149046: trixie-pu: package node-min-document/2.19.0+~cs2.20.2-2+deb13u1

[Xavier Guimard]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: node-min-document at packages.debian.org, yadd at debian.org
Control: affects -1 + src:node-min-document
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
node-min-document is vulnerable to a prototype pollution
(CVE-2025-57352 #1116340).

[ Impact ]
Security issue

[ Tests ]
Test pass (patch is exactly the "unstable" change.

[ Risks ]
No risk, patch is trivial

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Use Object.prototype.hasOwnProperty to avoid prototype pollution

Cheers,
Xavier
-------------- next part --------------
diff --git a/debian/changelog b/debian/changelog
index f680f36..6d0e46f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+node-min-document (2.19.0+~cs2.20.2-2+deb13u1) trixie; urgency=medium
+
+  * Fix prototype polution (Closes: #1116340, CVE-2025-57352)
+
+ -- Xavier Guimard <yadd at debian.org>  Sat, 26 Sep 2026 13:00:01 +0200
+
 node-min-document (2.19.0+~cs2.20.2-2) unstable; urgency=medium
 
   * Source-only upload
diff --git a/debian/patches/CVE-2025-57352.patch b/debian/patches/CVE-2025-57352.patch
new file mode 100644
index 0000000..2ed2637
--- /dev/null
+++ b/debian/patches/CVE-2025-57352.patch
@@ -0,0 +1,28 @@
+Description: Prevent prototype pollution in removeAttributeNS
+ Only delete attribute namespaces and attributes that are direct properties
+ of the attributes object, so that the __proto__ property cannot be used to
+ manipulate the prototype chain of JavaScript objects (CVE-2025-57352).
+Origin: upstream, https://github.com/Raynos/min-document/commit/fe32e8da
+Bug: https://github.com/Raynos/min-document/issues/54
+Bug-Debian: https://bugs.debian.org/1116340
+Forwarded: yes
+Last-Update: 2026-09-26
+
+--- a/dom-element.js
++++ b/dom-element.js
+@@ -128,9 +128,13 @@
+ 
+ DOMElement.prototype.removeAttributeNS =
+     function _Element_removeAttributeNS(namespace, name) {
++        // Prevent prototype pollution by checking if namespace is a direct property
++        if (!Object.prototype.hasOwnProperty.call(this._attributes, namespace)) {
++            return;
++        }
+         var attributes = this._attributes[namespace];
+-        if (attributes) {
+-            delete attributes[name]
++        if (attributes && Object.prototype.hasOwnProperty.call(attributes, name)) {
++            delete attributes[name];
+         }
+     }
+ 
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..7c1ff7f
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+CVE-2025-57352.patch