[security] Fix DoS vulnerability

Ignore extension and parameter names that are property names of
`Object.prototype` when parsing the `Sec-WebSocket-Extensions` header.

Author: lpinca

lib/Extensions.js

@@ -20,7 +20,13 @@ function parse(value) {
   value.split(',').forEach(function(v) {
     var params = v.split(';');
     var token = params.shift().trim();
-    var paramsList = extensions[token] = extensions[token] || [];
+
+    if (extensions[token] === undefined) {
+      extensions[token] = [];
+    } else if (!extensions.hasOwnProperty(token)) {
+      return;
+    }
+
     var parsedParams = {};
 
     params.forEach(function(param) {
@@ -38,10 +44,15 @@ function parse(value) {
           value = value.slice(0, value.length - 1);
         }
       }
-      (parsedParams[key] = parsedParams[key] || []).push(value);
+
+      if (parsedParams[key] === undefined) {
+        parsedParams[key] = [value];
+      } else if (parsedParams.hasOwnProperty(key)) {
+        parsedParams[key].push(value);
+      }
     });
 
-    paramsList.push(parsedParams);
+    extensions[token].push(parsedParams);
   });
 
   return extensions;

test/Extensions.test.js

@@ -29,6 +29,11 @@ describe('Extensions', function() {
         foo: [{ bar: ['hi'] }]
       });
     });
+
+    it('ignores names that match Object.prototype properties', function () {
+      Extensions.parse('hasOwnProperty, toString').should.eql({});
+      Extensions.parse('foo; constructor').should.eql({ foo: [{}] });
+    });
   });
 
   describe('format', function() {