fix: fixed prototype pollution issue

kobezzza · Mar 10, 2023 · d3d9376 · d3d9376
1 parent aacbd7f
commit d3d9376
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/iterators/extend.js b/src/iterators/extend.js
@@ -218,6 +218,10 @@ Collection.prototype.extend = function (deepOrParams, args) {
 			isSimple = simpleType[getType(arg)];
 
 		promise = promise.then(() => $C(arg).forEach((el, key) => {
+			if (key === '__proto__') {
+				return;
+			}
+
 			if (dataIsSimple && isSimple && (withDescriptor || p.withAccessors && (el.get || el.set))) {
 				if (p.traits && key in data !== (p.traits === -1)) {
 					return;