Merge pull request from GHSA-rrqm-p222-8ph2

Fixing prototype pollution
dynamoose · Feb 6, 2021 · 324c62b · 324c62b · vercel · Feb 6, 2021
2 parents 329d59d + 016703f
commit 324c62b
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/lib/utils/object/set.ts b/lib/utils/object/set.ts
@@ -15,7 +15,10 @@ export = <T>(object: GeneralObject<T>, key: string, value: any): GeneralObject<T
 		objectRef = objectRef[part];
 	});
 
-	objectRef[keyParts[keyParts.length - 1]] = value;
+	const finalKey: string = keyParts[keyParts.length - 1];
+	if (finalKey !== "__proto__" && finalKey !== "constructor") {
+		objectRef[finalKey] = value;
+	}
 
 	return object;
 };
diff --git a/test/unit/utils/object/set.js b/test/unit/utils/object/set.js
@@ -38,6 +38,14 @@ describe("utils.object.set", () => {
 		{
 			"input": [{"data": []}, "data.0", {"hello": "world"}],
 			"output": {"data": [{"hello": "world"}]}
+		},
+		{
+			"input": [{}, "__proto__", "Hello"],
+			"output": {}
+		},
+		{
+			"input": [{}, "constructor", "Hello"],
+			"output": {}
 		}
 	];