fix(Moddle): replicate set/get API for createAny elements

lib/moddle.js

@@ -1,7 +1,8 @@
 import {
   isString,
   isObject,
-  forEach
+  forEach,
+  set
 } from 'min-dash';
 
 import Factory from './factory.js';
@@ -142,11 +143,11 @@ Moddle.prototype.createAny = function(name, nsUri, properties) {
     $instanceOf: function(type) {
       return type === this.$type;
     },
-    get: function(name) {
-      return this[name];
+    get: function(key) {
+      return this[key];
     },
-    set: function(name, value) {
-      this[name] = value;
+    set: function(key, value) {
+      set(this, [ key ], value);
     }
   };
 

test/spec/moddle.js

@@ -230,6 +230,33 @@ describe('moddle', function() {
         // then
         expect(anyInstance.get('bar')).to.eql('BAR');
       });
+
+
+      it('should prevent prototype pollution', function() {
+
+        // given
+        var anyInstance = model.createAny('other:Foo', 'http://other');
+
+        // when
+
+        expect(function() {
+          anyInstance.set('__proto__', { hacked() { console.log('hacked'); } });
+        }).to.throw('illegal key: __proto__');
+
+      });
+
+
+      it('should NOT allow array as key', function() {
+
+        // given
+        var anyInstance = model.createAny('other:Foo', 'http://other');
+
+        // when
+        expect(function() {
+          anyInstance.set([ 'path', 'to', 'key' ], 'value');
+        }).to.throw('illegal key type: object. Key should be of type number or string.');
+      });
+
     });