From 177a35d2136d3dc415f281cf5bf2b55dc62831c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Go=C5=82e=CC=A8biowski-Owczarek?=
 <m.goleb@gmail.com>
Date: Mon, 28 Oct 2024 18:24:10 +0100
Subject: [PATCH] Widget: Don't let widget name affect `$.ui` prototype &
 constructor

This is an edge case and it only affects code accepting untrusted input as
a widget name, but it's still technically correct to filter these out.
---
 tests/unit/widget/core.js | 22 ++++++++++++++++++++++
 ui/widget.js              |  3 +++
 2 files changed, 25 insertions(+)

diff --git a/tests/unit/widget/core.js b/tests/unit/widget/core.js
index fe74e18e94..38e63a8c05 100644
--- a/tests/unit/widget/core.js
+++ b/tests/unit/widget/core.js
@@ -242,6 +242,28 @@ QUnit.test( "error handling", function( assert ) {
 	$.error = error;
 } );
 
+QUnit.test( "Prototype pollution", function( assert ) {
+	assert.expect( 3 );
+
+	var elem = $( "<div>" );
+
+	$.widget( "ui.testWidget", {} );
+
+	elem.testWidget();
+
+	try {
+		$.widget( "ui.__proto__", {} );
+	} catch ( _e ) {}
+	try {
+		$.widget( "ui.constructor", {} );
+	} catch ( _e ) {}
+
+	assert.strictEqual( Object.getPrototypeOf( $.ui ), Object.prototype,
+		"$.ui constructor not modified" );
+	assert.ok( $.ui instanceof Object, "$.ui is an Object instance" );
+	assert.notOk( $.ui instanceof Function, "$.ui is not a Function instance" );
+} );
+
 QUnit.test( "merge multiple option arguments", function( assert ) {
 	assert.expect( 1 );
 	$.widget( "ui.testWidget", {
diff --git a/ui/widget.js b/ui/widget.js
index 7201b4fbf6..d5fbd885cf 100644
--- a/ui/widget.js
+++ b/ui/widget.js
@@ -56,6 +56,9 @@ $.widget = function( name, base, prototype ) {
 
 	var namespace = name.split( "." )[ 0 ];
 	name = name.split( "." )[ 1 ];
+	if ( name === "__proto__" || name === "constructor" ) {
+		return $.error( "Invalid widget name: " + name );
+	}
 	var fullName = namespace + "-" + name;
 
 	if ( !prototype ) {