Prototype pollution fix

418sec · Jan 10, 2021 · fd3d818 · fd3d818
1 parent fb360e6
commit fd3d818
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/simpleDeepAssign.js b/simpleDeepAssign.js
@@ -35,6 +35,9 @@ function isObject(item/*: any*/)/*: boolean*/ {
  */
 function deepAssignObject(target/*: Object*/, source/*: Object*/)/*: void*/ {
   Object.keys(source).forEach(key => {
+    if (key === '__proto__' || key === 'prototype' || key === 'constructor'){
+      return;
+    }
     if (isObject(target[key]) && isObject(source[key])) {
       deepAssignObject(target[key], source[key]);
       return;