We are using a third party to assess security risks, and something in our Hubspot tracking script has been flagged for prototype pollution. After closer inspection - I believe it could be dependency on the jquery deparam package. Since I can see this in the script
hstc.utils.deparam = function (t, e) { var i = {}, n = { true: !0, false: !1, null: null };
However according to this hubspot introduced a fix which was
hstc.utils.deparam = function(t, e) { var n = Object.create(null)
This script is automatically added by standard_footer_includes template variable.
Can someone confirm please if this is the case? And if so - why, I have code which is still incorporating this security risk - and ideally how I should fix since there is no fix for the jquery-param package?
I would also like to know how to remove the tracking all altogether if its going to cause issues.
We are developing this theme and it is from a custom_theme however we have inherited this from another developer and can’t see anything obvious in the templates for where this would be changed to alter the tracking script. At the moment all I can see is this probematic script is added whenenever standard_footer_includes as added.
Thanks, yes I had found this - this is empty. So even though stand_footer_includes adds the tracking - some other scripts are being added in this var by Hubspot at another point?
Hi thanks for your reply. Yes this from a custom theme - which we inherited from another contarct developer. Can you suggest where this might be set - or how we would add hubspot updates to that tracking script ? Thanks
I wasn’t able to find it in their documentation directly.
@Anton have you been able to confirm the new script is implemented on any sites? based on the responses, I may have misunderstood the initial question and am not sure this is even possible.
Hi Jennifer. Thanks for getting back to me. This was a open source article showing how HubSpot - according to the article - previously suffered this security risk - which was reported by security researchers via BugCrowd and solved by Hubspot. This solution was then shared as a case study for the community. The Hubspot technical documentation does not go into any detail about this.
Please see an image from my console which proves prototype pollution is possible on my current site. I have a POC in a repo which proves this is caused by the tracking script included in our Hubspot instance. I’ve also proved that the prototype polution is caused by the deparam method in the tracking script - which was reportedly the method which was “fixed” in the case study. Hence, my confusion why this still appears possible.
I have raised this on BugCrowd - but I am facing pushback from their team since I cannot use “existing real customers of HubSpot can’t be accepted”. Given the tracking script is based each users site ID - I’m not sure how I’m supposed to get round this. Apologies if this is the wrong way to go about this but I am not a security reseracher - I am hubspot customer and dev - trying to get this resolved for third party security checks!
Could you point me in the direction of where I should share my POC - wary of doing so publicly here?
@JosieAilsa I would recommend submitting a ticket directly to HubSpot Support, they can escalate this request to the product engineers for the tracking script to determine the best way forward.
