{"repro_id":"REPRO-2026-00097","version":4,"title":"CASL Ability: Prototype Pollution via Condition Handling","repro_type":"security","status":"published","severity":"critical","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","root_cause":"# Root Cause Analysis: GHSA-x9vf-53q3-cvx6\n\n## Summary\n\nThe CASL Ability library (versions 2.4.0 through 6.7.4) contains a prototype pollution vulnerability in the `setByPath` utility function. When the `rulesToFields` function processes ability rules containing malicious condition keys like `__proto__.polluted`, it passes these paths to `setByPath`, which unsafely traverses and modifies object properties without validating against dangerous property names. This allows attackers to pollute `Object.prototype`, potentially leading to privilege escalation, denial of service, or unauthorized access across the entire application.\n\n## Impact\n\n- **Package**: `@casl/ability` (npm)\n- **Affected Versions**: >= 2.4.0, <= 6.7.4\n- **Fixed in Version**: 6.7.5\n- **CVE**: CVE-2026-1774\n- **CVSS**: 9.8 (CRITICAL)\n- **CVSS Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`\n- **CWE**: CWE-1321 (Prototype Pollution)\n\n### Risk Level and Consequences\n\nThis is a critical severity vulnerability with the following potential impacts:\n- **Confidentiality**: High - Attackers may bypass authorization checks by manipulating object properties\n- **Integrity**: High - Modified prototypes can alter application behavior globally\n- **Availability**: High - Polluted prototypes can cause application crashes or infinite loops\n\nThe vulnerability affects any application using the `rulesToFields` function from `@casl/ability/extra` with user-controlled rule conditions.\n\n## Root Cause\n\nThe vulnerability exists in the `setByPath` function in `packages/casl-ability/src/utils.ts`. This function sets nested properties on an object using a dot-notation path string. Prior to the fix, `setByPath` did not validate the property names within the path, allowing dangerous properties like `__proto__`, `constructor`, and `prototype` to be used in paths.\n\n### Vulnerable Code Pattern\n\n```typescript\n// Vulnerable version (before 6.7.5)\nexport function setByPath(object: AnyObject, path: string, value: unknown): void {\n  let ref = object;\n  let lastKey = path;\n\n  if (path.indexOf('.') !== -1) {\n    const keys = path.split('.');\n    lastKey = keys.pop()!;\n    ref = keys.reduce((res, prop) => {\n      // NO VALIDATION - dangerous properties allowed\n      res[prop] = res[prop] || {};\n      return res[prop] as AnyObject;\n    }, object);\n  }\n\n  ref[lastKey] = value; // Direct assignment without validation\n}\n```\n\n### Attack Vector\n\nThe `rulesToFields` function is part of the public API and is commonly used to extract rule conditions into field objects. When an attacker can control the conditions of rules passed to `rulesToFields`, they can craft a malicious path:\n\n```javascript\ncan('read', 'Post', { '__proto__.__pollutedValue__': 1 })\n```\n\nWhen `rulesToFields` processes this rule, it calls:\n```javascript\nsetByPath(fields, '__proto__.__pollutedValue__', 1)\n```\n\nThis traverses `fields.__proto__` (which is `Object.prototype`) and sets `__pollutedValue__ = 1`, polluting the global object prototype.\n\n### Fix\n\nThe patch introduces a `FORBIDDEN_PROPERTIES` set and validates each property in the path:\n\n```typescript\nconst FORBIDDEN_PROPERTIES = new Set(['__proto__', 'constructor', 'prototype']);\n\nexport function setByPath(object: AnyObject, path: string, value: unknown): void {\n  // ... path splitting ...\n  \n  ref = keys.reduce((res, prop) => {\n    if (FORBIDDEN_PROPERTIES.has(prop)) return res; // BLOCKED\n    res[prop] = res[prop] || {};\n    return res[prop] as AnyObject;\n  }, object);\n\n  if (!FORBIDDEN_PROPERTIES.has(lastKey)) {\n    ref[lastKey] = value; // Only set if not forbidden\n  }\n}\n```\n\n**Fix Commit**: https://github.com/stalniy/casl/commit/39da920ec1dfadf3655e28bd0389e960ac6871f4\n\n## Reproduction Steps\n\nThe reproduction script is located at `repro/reproduction_steps.sh`.\n\n### What the Script Does\n\n1. **Installs vulnerable version (6.7.3)**: Sets up a test environment with the vulnerable `@casl/ability` package\n2. **Tests prototype pollution**: Creates an ability with a malicious condition containing `__proto__.__pollutedValue__` and calls `rulesToFields`. Verifies that `Object.prototype` is polluted.\n3. **Installs patched version (6.7.5)**: Upgrades to the fixed version\n4. **Verifies the fix**: Repeats the test and confirms that `Object.prototype` is NOT polluted in the fixed version\n\n### Expected Evidence\n\nThe script produces the following evidence in `logs/`:\n- `npm_install_vuln.log` - Installation of vulnerable version\n- `test_vulnerable.log` - Demonstrates prototype pollution\n- `npm_install_fixed.log` - Installation of fixed version\n- `test_fixed.log` - Confirms fix works\n\n**Key Evidence from Vulnerable Version:**\n```\nBefore test: ({}).__pollutedValue__ = undefined\nAfter rulesToFields: ({}).__pollutedValue__ = 1\nReturned fields: {}\n[FAIL] Prototype pollution confirmed! Object.prototype was polluted.\n```\n\n**Key Evidence from Fixed Version:**\n```\nBefore test: ({}).__pollutedValue__ = undefined\nAfter rulesToFields: ({}).__pollutedValue__ = undefined\nReturned fields: {\"__pollutedValue__\":1}\n[PASS] Fix confirmed! Object.prototype was NOT polluted.\n```\n\nNote: In the fixed version, the value is stored in the returned fields object (as expected) but does NOT pollute the global `Object.prototype`.\n\n## Evidence\n\nAll evidence is captured in the `logs/` directory:\n- `/root/.pruva/runs/ghsa-x9vf-53q3-cvx6_20260219-193039/logs/npm_install_vuln.log`\n- `/root/.pruva/runs/ghsa-x9vf-53q3-cvx6_20260219-193039/logs/test_vulnerable.log`\n- `/root/.pruva/runs/ghsa-x9vf-53q3-cvx6_20260219-193039/logs/npm_install_fixed.log`\n- `/root/.pruva/runs/ghsa-x9vf-53q3-cvx6_20260219-193039/logs/test_fixed.log`\n\n### Environment Details\n\n- **Node.js**: Available via npm\n- **Tested Versions**: \n  - Vulnerable: 6.7.3 (also affected 2.4.0 through 6.7.4)\n  - Fixed: 6.7.5\n- **Test Environment**: Linux, npm package manager\n\n## Recommendations / Next Steps\n\n### Immediate Actions\n\n1. **Upgrade**: Update `@casl/ability` to version 6.7.5 or later immediately\n   ```bash\n   npm install @casl/ability@^6.7.5\n   ```\n\n2. **Audit**: Check if your application uses `rulesToFields` with user-controlled rule conditions\n\n3. **Input Validation**: Until patched, sanitize any user input that might be used in ability rule conditions\n\n### Testing Recommendations\n\n1. Run `npm audit` to identify vulnerable dependencies\n2. Review code that constructs ability rules from user input\n3. Add regression tests using the reproduction approach in this report\n4. Monitor for suspicious rule conditions containing `__proto__`, `constructor`, or `prototype` keys\n\n### Long-term Prevention\n\n1. Implement automated security scanning in CI/CD pipelines\n2. Use lockfiles and audit checks in pre-commit hooks\n3. Subscribe to security advisories for @casl/ability\n\n## Additional Notes\n\n### Idempotency Confirmation\n\nThe reproduction script was executed **twice consecutively** with identical results:\n- Run 1: Exit code 0 (vulnerability confirmed)\n- Run 2: Exit code 0 (vulnerability confirmed)\n\nBoth runs successfully demonstrated:\n1. Vulnerable version (6.7.3) allows prototype pollution\n2. Fixed version (6.7.5) prevents prototype pollution\n\n### Edge Cases and Limitations\n\n- The vulnerability requires the use of `rulesToFields` function with user-controlled conditions\n- Applications that only use basic ability checks without `rulesToFields` may not be directly exploitable\n- The fix properly handles both dot-notation paths (`__proto__.polluted`) and direct property assignments\n- The fix also protects against `constructor.prototype` attack variants\n","ghsa_id":"GHSA-x9vf-53q3-cvx6","cve_id":"CVE-2026-1774","source_url":"https://github.com/advisories/GHSA-x9vf-53q3-cvx6","package":{"name":"@casl/ability","ecosystem":"npm","affected_versions":">= 2.4.0, <= 6.7.4","fixed_version":"6.7.5"},"reproduced_at":"2026-02-19T19:47:47.650011+00:00","duration_secs":379.1689016819,"tool_calls":78,"turns":48,"handoffs":2,"total_cost_usd":0.2335869,"agent_costs":{"repro":0.1046387,"support":0.016599,"vuln_variant":0.1123492},"cost_breakdown":{"repro":{"accounts/fireworks/models/kimi-k2p5":0.1046387},"support":{"accounts/fireworks/models/kimi-k2p5":0.016599},"vuln_variant":{"accounts/fireworks/models/kimi-k2p5":0.1123492}},"quality":{"idempotent_verified":false,"community_verifications":0},"published_at":"2026-02-19T19:47:50.643687+00:00","retracted":false,"artifacts":[{"path":"repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":4001,"category":"reproduction_script"},{"path":"repro/rca_report.md","filename":"rca_report.md","size":7540,"category":"analysis"},{"path":"bundle/ticket.json","filename":"ticket.json","size":4302,"category":"other"},{"path":"bundle/ticket.md","filename":"ticket.md","size":1286,"category":"ticket"},{"path":"bundle/source.json","filename":"source.json","size":2236,"category":"other"},{"path":"repro/casl/pnpm-workspace.yaml","filename":"pnpm-workspace.yaml","size":153,"category":"other"},{"path":"repro/casl/release-please-config.json","filename":"release-please-config.json","size":1322,"category":"other"},{"path":"repro/casl/packages/casl-angular/CHANGELOG.md","filename":"CHANGELOG.md","size":22767,"category":"documentation"},{"path":"repro/casl/packages/casl-angular/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-angular/package.json","filename":"package.json","size":2683,"category":"other"},{"path":"repro/casl/packages/casl-angular/tsconfig.types.json","filename":"tsconfig.types.json","size":186,"category":"other"},{"path":"repro/casl/packages/casl-angular/spec/AbilityServiceSignal.spec.ts","filename":"AbilityServiceSignal.spec.ts","size":1614,"category":"other"},{"path":"repro/casl/packages/casl-angular/spec/pipes.e2e.spec.ts","filename":"pipes.e2e.spec.ts","size":2307,"category":"other"},{"path":"repro/casl/packages/casl-angular/spec/spec_helper.ts","filename":"spec_helper.ts","size":1406,"category":"other"},{"path":"repro/casl/packages/casl-angular/spec/AbilityService.spec.ts","filename":"AbilityService.spec.ts","size":1295,"category":"other"},{"path":"repro/casl/packages/casl-angular/README.md","filename":"README.md","size":9504,"category":"documentation"},{"path":"repro/casl/packages/casl-angular/tsconfig.spec.json","filename":"tsconfig.spec.json","size":163,"category":"other"},{"path":"repro/casl/packages/casl-angular/tsconfig.json","filename":"tsconfig.json","size":677,"category":"other"},{"path":"repro/casl/packages/casl-angular/index.d.ts","filename":"index.d.ts","size":30,"category":"other"},{"path":"repro/casl/packages/casl-angular/src/pipes.ts","filename":"pipes.ts","size":1053,"category":"other"},{"path":"repro/casl/packages/casl-angular/src/public.ts","filename":"public.ts","size":99,"category":"other"},{"path":"repro/casl/packages/casl-angular/src/AbilityServiceSignal.ts","filename":"AbilityServiceSignal.ts","size":1016,"category":"other"},{"path":"repro/casl/packages/casl-angular/src/AbilityService.ts","filename":"AbilityService.ts","size":480,"category":"other"},{"path":"repro/casl/packages/casl-angular/tsconfig.build.json","filename":"tsconfig.build.json","size":75,"category":"other"},{"path":"repro/casl/packages/casl-angular/jest.config.js","filename":"jest.config.js","size":296,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/CHANGELOG.md","filename":"CHANGELOG.md","size":9657,"category":"documentation"},{"path":"repro/casl/packages/casl-aurelia/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/package.json","filename":"package.json","size":1910,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/spec/spec_helper.js","filename":"spec_helper.js","size":181,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/spec/plugin.spec.js","filename":"plugin.spec.js","size":3352,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/spec/.eslintrc","filename":".eslintrc","size":39,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/README.md","filename":"README.md","size":7447,"category":"documentation"},{"path":"repro/casl/packages/casl-aurelia/tsconfig.json","filename":"tsconfig.json","size":135,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/index.d.ts","filename":"index.d.ts","size":36,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/src/value-converter/can.ts","filename":"can.ts","size":1413,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/src/index.ts","filename":"index.ts","size":585,"category":"other"},{"path":"repro/casl/packages/casl-aurelia/tsconfig.build.json","filename":"tsconfig.build.json","size":121,"category":"other"},{"path":"repro/casl/packages/casl-prisma/runtime.js","filename":"runtime.js","size":49,"category":"other"},{"path":"repro/casl/packages/casl-prisma/CHANGELOG.md","filename":"CHANGELOG.md","size":7257,"category":"documentation"},{"path":"repro/casl/packages/casl-prisma/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-prisma/package.json","filename":"package.json","size":2109,"category":"other"},{"path":"repro/casl/packages/casl-prisma/spec/accessibleBy.spec.ts","filename":"accessibleBy.spec.ts","size":1169,"category":"other"},{"path":"repro/casl/packages/casl-prisma/spec/prismaQuery.spec.ts","filename":"prismaQuery.spec.ts","size":20995,"category":"other"},{"path":"repro/casl/packages/casl-prisma/spec/AppAbility.ts","filename":"AppAbility.ts","size":279,"category":"other"},{"path":"repro/casl/packages/casl-prisma/spec/createPrismaAbilityFor.spec.ts","filename":"createPrismaAbilityFor.spec.ts","size":593,"category":"other"},{"path":"repro/casl/packages/casl-prisma/spec/PrismaAbility.spec.ts","filename":"PrismaAbility.spec.ts","size":3188,"category":"other"},{"path":"repro/casl/packages/casl-prisma/README.md","filename":"README.md","size":8713,"category":"documentation"},{"path":"repro/casl/packages/casl-prisma/tsconfig.json","filename":"tsconfig.json","size":135,"category":"other"},{"path":"repro/casl/packages/casl-prisma/prisma.config.ts","filename":"prisma.config.ts","size":226,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/accessibleByFactory.ts","filename":"accessibleByFactory.ts","size":1920,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/errors/ParsingQueryError.ts","filename":"ParsingQueryError.ts","size":342,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/index.ts","filename":"index.ts","size":1573,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/types.ts","filename":"types.ts","size":1761,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/runtime.ts","filename":"runtime.ts","size":473,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/createAbilityFactory.ts","filename":"createAbilityFactory.ts","size":926,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/prisma/interpretPrismaQuery.ts","filename":"interpretPrismaQuery.ts","size":4044,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/prisma/prismaQuery.ts","filename":"prismaQuery.ts","size":1024,"category":"other"},{"path":"repro/casl/packages/casl-prisma/src/prisma/PrismaQueryParser.ts","filename":"PrismaQueryParser.ts","size":5913,"category":"other"},{"path":"repro/casl/packages/casl-prisma/tsconfig.build.json","filename":"tsconfig.build.json","size":121,"category":"other"},{"path":"repro/casl/packages/casl-prisma/schema.prisma","filename":"schema.prisma","size":389,"category":"other"},{"path":"repro/casl/packages/casl-prisma/runtime.d.ts","filename":"runtime.d.ts","size":38,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/CHANGELOG.md","filename":"CHANGELOG.md","size":17862,"category":"documentation"},{"path":"repro/casl/packages/casl-mongoose/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/package.json","filename":"package.json","size":1639,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/spec/accessibleFieldsBy.spec.ts","filename":"accessibleFieldsBy.spec.ts","size":2330,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/spec/accessibleBy.spec.ts","filename":"accessibleBy.spec.ts","size":5139,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/spec/accessible_records.spec.ts","filename":"accessible_records.spec.ts","size":4046,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/spec/accessible_fields.spec.ts","filename":"accessible_fields.spec.ts","size":4613,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/README.md","filename":"README.md","size":14386,"category":"documentation"},{"path":"repro/casl/packages/casl-mongoose/tsconfig.json","filename":"tsconfig.json","size":135,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/src/accessibleFieldsBy.ts","filename":"accessibleFieldsBy.ts","size":770,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/src/plugins/accessible_records.ts","filename":"accessible_records.ts","size":2227,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/src/plugins/accessible_fields.ts","filename":"accessible_fields.ts","size":3038,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/src/index.ts","filename":"index.ts","size":1140,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/src/accessibleBy.ts","filename":"accessibleBy.ts","size":1358,"category":"other"},{"path":"repro/casl/packages/casl-mongoose/tsconfig.build.json","filename":"tsconfig.build.json","size":121,"category":"other"},{"path":"repro/casl/packages/casl-vue/CHANGELOG.md","filename":"CHANGELOG.md","size":16162,"category":"documentation"},{"path":"repro/casl/packages/casl-vue/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-vue/package.json","filename":"package.json","size":1662,"category":"other"},{"path":"repro/casl/packages/casl-vue/spec/can.spec.ts","filename":"can.spec.ts","size":4353,"category":"other"},{"path":"repro/casl/packages/casl-vue/spec/plugin.spec.ts","filename":"plugin.spec.ts","size":2504,"category":"other"},{"path":"repro/casl/packages/casl-vue/spec/hooks.spec.ts","filename":"hooks.spec.ts","size":1770,"category":"other"},{"path":"repro/casl/packages/casl-vue/README.md","filename":"README.md","size":12233,"category":"documentation"},{"path":"repro/casl/packages/casl-vue/tsconfig.json","filename":"tsconfig.json","size":165,"category":"other"},{"path":"repro/casl/packages/casl-vue/src/reactiveAbility.ts","filename":"reactiveAbility.ts","size":683,"category":"other"},{"path":"repro/casl/packages/casl-vue/src/plugin.ts","filename":"plugin.ts","size":730,"category":"other"},{"path":"repro/casl/packages/casl-vue/src/useAbility.ts","filename":"useAbility.ts","size":596,"category":"other"},{"path":"repro/casl/packages/casl-vue/src/index.ts","filename":"index.ts","size":260,"category":"other"},{"path":"repro/casl/packages/casl-vue/src/component/can.ts","filename":"can.ts","size":2304,"category":"other"},{"path":"repro/casl/packages/casl-vue/tsconfig.build.json","filename":"tsconfig.build.json","size":66,"category":"other"},{"path":"repro/casl/packages/dx/lib/spec_helper.js","filename":"spec_helper.js","size":464,"category":"other"},{"path":"repro/casl/packages/dx/lib/spawn.js","filename":"spawn.js","size":530,"category":"other"},{"path":"repro/casl/packages/dx/lib/dx.js","filename":"dx.js","size":2659,"category":"other"},{"path":"repro/casl/packages/dx/package.json","filename":"package.json","size":1212,"category":"other"},{"path":"repro/casl/packages/dx/bin/dx.js","filename":"dx.js","size":82,"category":"other"},{"path":"repro/casl/packages/dx/tsconfig.json","filename":"tsconfig.json","size":143,"category":"other"},{"path":"repro/casl/packages/dx/config/jest.chai.config.js","filename":"jest.chai.config.js","size":155,"category":"other"},{"path":"repro/casl/packages/dx/config/babel.config.mjs","filename":"babel.config.mjs","size":1023,"category":"other"},{"path":"repro/casl/packages/dx/config/lintstaged.js","filename":"lintstaged.js","size":157,"category":"other"},{"path":"repro/casl/packages/dx/config/eslint.config.mjs","filename":"eslint.config.mjs","size":3122,"category":"other"},{"path":"repro/casl/packages/dx/config/jest.config.js","filename":"jest.config.js","size":371,"category":"other"},{"path":"repro/casl/packages/dx/config/rollup.config.mjs","filename":"rollup.config.mjs","size":3770,"category":"other"},{"path":"repro/casl/packages/casl-react/CHANGELOG.md","filename":"CHANGELOG.md","size":14594,"category":"documentation"},{"path":"repro/casl/packages/casl-react/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-react/package.json","filename":"package.json","size":1852,"category":"other"},{"path":"repro/casl/packages/casl-react/spec/factory.spec.tsx","filename":"factory.spec.tsx","size":1372,"category":"other"},{"path":"repro/casl/packages/casl-react/spec/Can.spec.tsx","filename":"Can.spec.tsx","size":4279,"category":"other"},{"path":"repro/casl/packages/casl-react/spec/useAbility.spec.ts","filename":"useAbility.spec.ts","size":1501,"category":"other"},{"path":"repro/casl/packages/casl-react/README.md","filename":"README.md","size":11101,"category":"documentation"},{"path":"repro/casl/packages/casl-react/tsconfig.json","filename":"tsconfig.json","size":197,"category":"other"},{"path":"repro/casl/packages/casl-react/index.d.ts","filename":"index.d.ts","size":30,"category":"other"},{"path":"repro/casl/packages/casl-react/src/Can.ts","filename":"Can.ts","size":2566,"category":"other"},{"path":"repro/casl/packages/casl-react/src/factory.ts","filename":"factory.ts","size":462,"category":"other"},{"path":"repro/casl/packages/casl-react/src/index.ts","filename":"index.ts","size":86,"category":"other"},{"path":"repro/casl/packages/casl-react/src/hooks/useAbility.ts","filename":"useAbility.ts","size":419,"category":"other"},{"path":"repro/casl/packages/casl-react/tsconfig.build.json","filename":"tsconfig.build.json","size":213,"category":"other"},{"path":"repro/casl/packages/casl-ability/extra.d.ts","filename":"extra.d.ts","size":36,"category":"other"},{"path":"repro/casl/packages/casl-ability/CHANGELOG.md","filename":"CHANGELOG.md","size":71654,"category":"documentation"},{"path":"repro/casl/packages/casl-ability/LICENSE","filename":"LICENSE","size":1077,"category":"other"},{"path":"repro/casl/packages/casl-ability/package.json","filename":"package.json","size":2082,"category":"other"},{"path":"repro/casl/packages/casl-ability/extra/package.json","filename":"package.json","size":209,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/spec_helper.js","filename":"spec_helper.js","size":446,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/permitted_fields.spec.js","filename":"permitted_fields.spec.js","size":2838,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/error.spec.ts","filename":"error.spec.ts","size":2985,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/ability.spec.ts","filename":"ability.spec.ts","size":30306,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/subject_helper.spec.ts","filename":"subject_helper.spec.ts","size":840,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/pack_rules.spec.ts","filename":"pack_rules.spec.ts","size":5779,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/rulesToQuery.spec.js","filename":"rulesToQuery.spec.js","size":5674,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/fixtures.ts","filename":"fixtures.ts","size":574,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/types/AbilityBuilder.spec.ts","filename":"AbilityBuilder.spec.ts","size":8120,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/types/Ability.spec.ts","filename":"Ability.spec.ts","size":4368,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/rulesToAST.spec.js","filename":"rulesToAST.spec.js","size":1915,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/rulesToFields.spec.ts","filename":"rulesToFields.spec.ts","size":2432,"category":"other"},{"path":"repro/casl/packages/casl-ability/spec/builder.spec.js","filename":"builder.spec.js","size":5045,"category":"other"},{"path":"repro/casl/packages/casl-ability/README.md","filename":"README.md","size":6457,"category":"documentation"},{"path":"repro/casl/packages/casl-ability/tsconfig.json","filename":"tsconfig.json","size":86,"category":"other"},{"path":"repro/casl/packages/casl-ability/index.d.ts","filename":"index.d.ts","size":30,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/AbilityBuilder.ts","filename":"AbilityBuilder.ts","size":5656,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/ForbiddenError.ts","filename":"ForbiddenError.ts","size":2395,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/extra/rulesToQuery.ts","filename":"rulesToQuery.ts","size":2568,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/extra/index.ts","filename":"index.ts","size":131,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/extra/permittedFieldsOf.ts","filename":"permittedFieldsOf.ts","size":2162,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/extra/rulesToFields.ts","filename":"rulesToFields.ts","size":896,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/extra/packRules.ts","filename":"packRules.ts","size":1949,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/hkt.ts","filename":"hkt.ts","size":555,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/structures/LinkedItem.ts","filename":"LinkedItem.ts","size":633,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/RuleIndex.ts","filename":"RuleIndex.ts","size":9626,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/matchers/conditions.ts","filename":"conditions.ts","size":1674,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/matchers/field.ts","filename":"field.ts","size":1520,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/PureAbility.ts","filename":"PureAbility.ts","size":2082,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/utils.ts","filename":"utils.ts","size":5420,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/index.ts","filename":"index.ts","size":848,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/types.ts","filename":"types.ts","size":2872,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/Rule.ts","filename":"Rule.ts","size":3303,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/Ability.ts","filename":"Ability.ts","size":1732,"category":"other"},{"path":"repro/casl/packages/casl-ability/src/RawRule.ts","filename":"RawRule.ts","size":976,"category":"other"},{"path":"repro/casl/packages/casl-ability/tsconfig.build.json","filename":"tsconfig.build.json","size":121,"category":"other"},{"path":"repro/casl/LICENSE","filename":"LICENSE","size":1080,"category":"other"},{"path":"repro/casl/package.json","filename":"package.json","size":305,"category":"other"},{"path":"repro/casl/.codeclimate.yml","filename":".codeclimate.yml","size":412,"category":"other"},{"path":"repro/casl/.github/actions/setup-deps/action.yml","filename":"action.yml","size":1044,"category":"other"},{"path":"repro/casl/.github/FUNDING.yml","filename":"FUNDING.yml","size":638,"category":"other"},{"path":"repro/casl/.github/workflows/main.yml","filename":"main.yml","size":1789,"category":"other"},{"path":"repro/casl/.github/workflows/docs.yml","filename":"docs.yml","size":2522,"category":"other"},{"path":"repro/casl/.github/workflows/release.yml","filename":"release.yml","size":1040,"category":"other"},{"path":"repro/casl/.github/workflows/diff-package-lock.yml","filename":"diff-package-lock.yml","size":3285,"category":"other"},{"path":"repro/casl/.github/ISSUE_TEMPLATE/bug_report.md","filename":"bug_report.md","size":1175,"category":"documentation"},{"path":"repro/casl/.github/ISSUE_TEMPLATE/feature_request.md","filename":"feature_request.md","size":962,"category":"documentation"},{"path":"repro/casl/README.md","filename":"README.md","size":13901,"category":"documentation"},{"path":"repro/casl/docs-src/index.html","filename":"index.html","size":3169,"category":"other"},{"path":"repro/casl/docs-src/tools/SearchIndex.js","filename":"SearchIndex.js","size":1194,"category":"other"},{"path":"repro/casl/docs-src/tools/mdLink.cjs","filename":"mdLink.cjs","size":2373,"category":"other"},{"path":"repro/casl/docs-src/tools/mdImage.cjs","filename":"mdImage.cjs","size":1015,"category":"other"},{"path":"repro/casl/docs-src/tools/stop-words/ru.txt","filename":"ru.txt","size":4537,"category":"other"},{"path":"repro/casl/docs-src/tools/stop-words/en.txt","filename":"en.txt","size":3526,"category":"other"},{"path":"repro/casl/docs-src/tools/stop-words/ua.txt","filename":"ua.txt","size":4132,"category":"other"},{"path":"repro/casl/docs-src/tools/prerender.js","filename":"prerender.js","size":4276,"category":"other"},{"path":"repro/casl/docs-src/tools/sitemap.xml.js","filename":"sitemap.xml.js","size":5526,"category":"other"},{"path":"repro/casl/docs-src/tools/mdTableContainer.cjs","filename":"mdTableContainer.cjs","size":359,"category":"other"},{"path":"repro/casl/docs-src/tools/contentParser.js","filename":"contentParser.js","size":1783,"category":"other"},{"path":"repro/casl/docs-src/public/manifest.json","filename":"manifest.json","size":415,"category":"other"},{"path":"repro/casl/docs-src/public/global.css","filename":"global.css","size":1075,"category":"other"},{"path":"repro/casl/docs-src/public/fonts/StardosStencil-Bold.woff2","filename":"StardosStencil-Bold.woff2","size":13836,"category":"other"},{"path":"repro/casl/docs-src/public/fonts/StardosStencil-Regular.woff2","filename":"StardosStencil-Regular.woff2","size":14840,"category":"other"},{"path":"repro/casl/docs-src/public/web-root/robots.txt","filename":"robots.txt","size":120,"category":"other"},{"path":"repro/casl/docs-src/public/web-root/404.html","filename":"404.html","size":2329,"category":"other"},{"path":"repro/casl/docs-src/public/web-root/google4f1edd737abc76a4.html","filename":"google4f1edd737abc76a4.html","size":54,"category":"other"},{"path":"repro/casl/docs-src/public/versions.txt","filename":"versions.txt","size":57,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/safari-pinned-tab.svg","filename":"safari-pinned-tab.svg","size":944,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/android-chrome-192x192.png","filename":"android-chrome-192x192.png","size":6417,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/favicon-32x32.png","filename":"favicon-32x32.png","size":890,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/favicon-16x16.png","filename":"favicon-16x16.png","size":561,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/mstile-150x150.png","filename":"mstile-150x150.png","size":3872,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/favicon.ico","filename":"favicon.ico","size":15086,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/apple-touch-icon.png","filename":"apple-touch-icon.png","size":5578,"category":"other"},{"path":"repro/casl/docs-src/public/app-icons/android-chrome-256x256.png","filename":"android-chrome-256x256.png","size":9484,"category":"other"},{"path":"repro/casl/docs-src/package.json","filename":"package.json","size":1256,"category":"other"},{"path":"repro/casl/docs-src/src/content/app/en.yml","filename":"en.yml","size":2950,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/api/casl-ability-extra/en.md","filename":"en.md","size":6021,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/api/casl-ability/en.md","filename":"en.md","size":15923,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-abilitybuilder-conditions-hints.png","filename":"casl-abilitybuilder-conditions-hints.png","size":62608,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-discriminated-class-subject.png","filename":"casl-discriminated-class-subject.png","size":10250,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-class-subject-with-name.png","filename":"casl-class-subject-with-name.png","size":9592,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-class-subject.png","filename":"casl-class-subject.png","size":15138,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-abilitybuilder-fields-hints.png","filename":"casl-abilitybuilder-fields-hints.png","size":16397,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/en.md","filename":"en.md","size":11497,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-abilitybuilder.png","filename":"casl-abilitybuilder.png","size":10348,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-tagged-union-subject.png","filename":"casl-tagged-union-subject.png","size":12716,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-subject-hints.png","filename":"casl-subject-hints.png","size":7700,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/typescript/casl-action-hints.png","filename":"casl-action-hints.png","size":6170,"category":"other"},{"path":"repro/casl/docs-src/src/content/pages/advanced/debugging-testing/en.md","filename":"en.md","size":7862,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/advanced/customize-ability/en.md","filename":"en.md","size":5882,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/advanced/ability-inheritance/en.md","filename":"en.md","size":241,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/advanced/ability-to-database-query/en.md","filename":"en.md","size":4531,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/support-casljs/en.md","filename":"en.md","size":1753,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/notfound/en.md","filename":"en.md","size":194,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/conditions-in-depth/en.md","filename":"en.md","size":12158,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/subject-type-detection/en.md","filename":"en.md","size":7704,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/intro/en.md","filename":"en.md","size":17326,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/define-aliases/en.md","filename":"en.md","size":3247,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/install/en.md","filename":"en.md","size":8325,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/define-rules/en.md","filename":"en.md","size":10089,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/guide/restricting-fields/en.md","filename":"en.md","size":8480,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-angular/en.md","filename":"en.md","size":329,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-aurelia/en.md","filename":"en.md","size":306,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-prisma/en.md","filename":"en.md","size":342,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-mongoose/en.md","filename":"en.md","size":345,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-vue/en.md","filename":"en.md","size":309,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/package/casl-react/en.md","filename":"en.md","size":325,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/cache-rules/en.md","filename":"en.md","size":7321,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/intro/en.md","filename":"en.md","size":4525,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/roles-with-persisted-permissions/en.md","filename":"en.md","size":16059,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/roles-with-static-permissions/en.md","filename":"en.md","size":11807,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/less-confusing-can-api/en.md","filename":"en.md","size":2407,"category":"documentation"},{"path":"repro/casl/docs-src/src/content/pages/cookbook/claim-authorization/en.md","filename":"en.md","size":3162,"category":"documentation"},{"path":"repro/casl/docs-src/src/app.js","filename":"app.js","size":1797,"category":"other"},{"path":"repro/casl/docs-src/src/vite-env.d.ts","filename":"vite-env.d.ts","size":830,"category":"other"},{"path":"repro/casl/docs-src/src/partials/caslFeatures.js","filename":"caslFeatures.js","size":1007,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppHeader.js","filename":"AppHeader.js","size":4224,"category":"other"},{"path":"repro/casl/docs-src/src/components/Page.js","filename":"Page.js","size":2285,"category":"other"},{"path":"repro/casl/docs-src/src/components/PagesByCategories.js","filename":"PagesByCategories.js","size":1084,"category":"other"},{"path":"repro/casl/docs-src/src/components/LangPicker.js","filename":"LangPicker.js","size":687,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppNotification.js","filename":"AppNotification.js","size":631,"category":"other"},{"path":"repro/casl/docs-src/src/components/OneTimeDonations.js","filename":"OneTimeDonations.js","size":1950,"category":"other"},{"path":"repro/casl/docs-src/src/components/VersionsSelect.js","filename":"VersionsSelect.js","size":2281,"category":"other"},{"path":"repro/casl/docs-src/src/components/PageNav.js","filename":"PageNav.js","size":1168,"category":"other"},{"path":"repro/casl/docs-src/src/components/QuickSearch.js","filename":"QuickSearch.js","size":7541,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppRoot.js","filename":"AppRoot.js","size":1822,"category":"other"},{"path":"repro/casl/docs-src/src/components/GithubButton.js","filename":"GithubButton.js","size":1016,"category":"other"},{"path":"repro/casl/docs-src/src/components/HomePage.js","filename":"HomePage.js","size":2877,"category":"other"},{"path":"repro/casl/docs-src/src/components/ArticleDetails.js","filename":"ArticleDetails.js","size":1450,"category":"other"},{"path":"repro/casl/docs-src/src/components/I18nElement.js","filename":"I18nElement.js","size":685,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppMenu.js","filename":"AppMenu.js","size":3354,"category":"other"},{"path":"repro/casl/docs-src/src/components/App.js","filename":"App.js","size":3465,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppFooter.js","filename":"AppFooter.js","size":3628,"category":"other"},{"path":"repro/casl/docs-src/src/components/MenuDrawer.js","filename":"MenuDrawer.js","size":2980,"category":"other"},{"path":"repro/casl/docs-src/src/components/AppLink.js","filename":"AppLink.js","size":2559,"category":"other"},{"path":"repro/casl/docs-src/src/components/OldVersionAlert.js","filename":"OldVersionAlert.js","size":1397,"category":"other"},{"path":"repro/casl/docs-src/src/serviceWorker.js","filename":"serviceWorker.js","size":2964,"category":"other"},{"path":"repro/casl/docs-src/src/directives/i18n.js","filename":"i18n.js","size":503,"category":"other"},{"path":"repro/casl/docs-src/src/styles/md.js","filename":"md.js","size":1821,"category":"other"},{"path":"repro/casl/docs-src/src/styles/alert.js","filename":"alert.js","size":259,"category":"other"},{"path":"repro/casl/docs-src/src/styles/code.js","filename":"code.js","size":2011,"category":"other"},{"path":"repro/casl/docs-src/src/styles/page.js","filename":"page.js","size":460,"category":"other"},{"path":"repro/casl/docs-src/src/styles/index.js","filename":"index.js","size":266,"category":"other"},{"path":"repro/casl/docs-src/src/styles/grid.js","filename":"grid.js","size":468,"category":"other"},{"path":"repro/casl/docs-src/src/styles/btn.js","filename":"btn.js","size":659,"category":"other"},{"path":"repro/casl/docs-src/src/hooks/watchMedia.js","filename":"watchMedia.js","size":315,"category":"other"},{"path":"repro/casl/docs-src/src/hooks/scrollToSection.js","filename":"scrollToSection.js","size":1333,"category":"other"},{"path":"repro/casl/docs-src/src/bootstrap.js","filename":"bootstrap.js","size":427,"category":"other"},{"path":"repro/casl/docs-src/src/services/utils.js","filename":"utils.js","size":546,"category":"other"},{"path":"repro/casl/docs-src/src/services/meta.js","filename":"meta.js","size":1954,"category":"other"},{"path":"repro/casl/docs-src/src/services/content.js","filename":"content.js","size":354,"category":"other"},{"path":"repro/casl/docs-src/src/services/error.js","filename":"error.js","size":116,"category":"other"},{"path":"repro/casl/docs-src/src/services/version.js","filename":"version.js","size":419,"category":"other"},{"path":"repro/casl/docs-src/src/services/ContentType.js","filename":"ContentType.js","size":3647,"category":"other"},{"path":"repro/casl/docs-src/src/services/pageController.js","filename":"pageController.js","size":1893,"category":"other"},{"path":"repro/casl/docs-src/src/services/http.js","filename":"http.js","size":1771,"category":"other"},{"path":"repro/casl/docs-src/src/services/router.js","filename":"router.js","size":3103,"category":"other"},{"path":"repro/casl/docs-src/src/services/querystring.js","filename":"querystring.js","size":387,"category":"other"},{"path":"repro/casl/docs-src/src/services/i18n.js","filename":"i18n.js","size":1713,"category":"other"},{"path":"repro/casl/docs-src/src/config/menu.yml","filename":"menu.yml","size":1109,"category":"other"},{"path":"repro/casl/docs-src/src/config/app.js","filename":"app.js","size":99,"category":"other"},{"path":"repro/casl/docs-src/src/config/search.js","filename":"search.js","size":418,"category":"other"},{"path":"repro/casl/docs-src/src/config/routes.yml","filename":"routes.yml","size":937,"category":"other"},{"path":"repro/casl/docs-src/.env","filename":".env","size":172,"category":"other"},{"path":"repro/casl/docs-src/.env.production","filename":".env.production","size":123,"category":"other"},{"path":"repro/casl/docs-src/.gitignore","filename":".gitignore","size":249,"category":"other"},{"path":"repro/casl/docs-src/vite.config.js","filename":"vite.config.js","size":4726,"category":"other"},{"path":"repro/casl/tsconfig.json","filename":"tsconfig.json","size":245,"category":"other"},{"path":"repro/casl/.renovaterc","filename":".renovaterc","size":1478,"category":"other"},{"path":"repro/casl/.release-please-manifest.json","filename":".release-please-manifest.json","size":249,"category":"other"},{"path":"repro/casl/CONTRIBUTING.md","filename":"CONTRIBUTING.md","size":4695,"category":"documentation"},{"path":"repro/casl/BACKERS.md","filename":"BACKERS.md","size":1895,"category":"documentation"},{"path":"repro/casl/.gitignore","filename":".gitignore","size":878,"category":"other"},{"path":"repro/casl/git-hooks/pre-commit","filename":"pre-commit","size":56,"category":"other"},{"path":"repro/casl/git-hooks/.gitignore","filename":".gitignore","size":2,"category":"other"},{"path":"repro/casl/pnpm-lock.yaml","filename":"pnpm-lock.yaml","size":528917,"category":"other"},{"path":"logs/variant3.log","filename":"variant3.log","size":145,"category":"log"},{"path":"logs/npm_install_current.log","filename":"npm_install_current.log","size":126,"category":"log"},{"path":"logs/variant5.log","filename":"variant5.log","size":150,"category":"log"},{"path":"logs/variant8.log","filename":"variant8.log","size":96,"category":"log"},{"path":"logs/variant4.log","filename":"variant4.log","size":201,"category":"log"},{"path":"logs/variant7.log","filename":"variant7.log","size":93,"category":"log"},{"path":"logs/test_vulnerable.log","filename":"test_vulnerable.log","size":186,"category":"log"},{"path":"logs/npm_install_fixed.log","filename":"npm_install_fixed.log","size":137,"category":"log"},{"path":"logs/variant2.log","filename":"variant2.log","size":129,"category":"log"},{"path":"logs/variant1.log","filename":"variant1.log","size":129,"category":"log"},{"path":"logs/npm_install_vuln.log","filename":"npm_install_vuln.log","size":221,"category":"log"},{"path":"logs/variant6.log","filename":"variant6.log","size":295,"category":"log"},{"path":"logs/test_fixed.log","filename":"test_fixed.log","size":203,"category":"log"}]}