GHSA-vj5c-m527-mpff Style Dictionary - Prototype Pollution in convertTokenData utility function

• npm style-dictionary: >= 4.3.0, < 5.4.4 → fixed in 5.4.4

Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious' }]`, when processed by `convertTokenData()` utility function, it will pollute the Object.prototype globally where `{}.foo` will equal `{ key: '{__proto__.foo}', value: 'malicious' }`. This has been confirmed with a test/reproduction. You are impacted when: • direct usage of `convertTokenData(tokens, { output: 'object' });` • indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the `sd.tokens` property with the `sd.tokenMap` property by converting tokenData map back to object. • indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the `sd.tokens` property with the `sd.tokenMap` property. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. Patches A patch has been published: version `5.4.4`. Any version within range `>=4.3.0 tok.key.includes('__proto__')) { throw new Error('Found malicious token key, attempting to do prototype pollution.') } ```