fix(deepMerge): prototype pollution

antfu · May 30, 2023 · 7f8b16c · 7f8b16c
1 parent 1106872
commit 7f8b16c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/src/object.test.ts b/src/object.test.ts
@@ -51,4 +51,16 @@ describe('deepMerge', () => {
     const obj2 = { a: ['C'], b: ['D'] }
     expect(deepMerge({}, obj1, obj2)).toEqual({ a: ['C'], b: ['D'] })
   })
+
+  it('prototype pollution 1', () => {
+    const obj = {} as any
+    const obj2 = {} as any
+    const payload = JSON.parse('{"__proto__":{"polluted":"Polluted!"}}')
+
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+    deepMerge(obj, payload)
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+  })
 })
diff --git a/src/object.ts b/src/object.ts
@@ -82,6 +82,9 @@ export function deepMerge<T extends object = object, S extends object = T>(targe
 
   if (isMergableObject(target) && isMergableObject(source)) {
     objectKeys(source).forEach((key) => {
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+        return
+
       // @ts-expect-error
       if (isMergableObject(source[key])) {
         // @ts-expect-error