Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Ensure Object.prototype is not augmented by _.merge.
- Loading branch information
Showing
with
34 additions
and
14 deletions.
-
+23
−14
lodash.js
-
+11
−0
test/test.js
|
@@ -1224,20 +1224,6 @@ |
|
|
return result; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Gets the value at `key`, unless `key` is "__proto__". |
|
|
* |
|
|
* @private |
|
|
* @param {Object} object The object to query. |
|
|
* @param {string} key The key of the property to get. |
|
|
* @returns {*} Returns the property value. |
|
|
*/ |
|
|
function safeGet(object, key) { |
|
|
return key == '__proto__' |
|
|
? undefined |
|
|
: object[key]; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Converts `set` to an array of its values. |
|
|
* |
|
@@ -6618,6 +6604,29 @@ |
|
|
return array; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Gets the value at `key`, unless `key` is "__proto__" or "prototype". |
|
|
* |
|
|
* @private |
|
|
* @param {Object} object The object to query. |
|
|
* @param {string} key The key of the property to get. |
|
|
* @returns {*} Returns the property value. |
|
|
*/ |
|
|
function safeGet(object, key) { |
|
|
if (key == '__proto__') { |
|
|
return; |
|
|
} |
|
|
|
|
|
var value = object[key]; |
|
|
|
|
|
if (key == 'prototype' && |
|
|
value === objectProto) { |
|
|
return; |
|
|
} |
|
|
|
|
|
return value; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Sets metadata for `func`. |
|
|
* |
|
|
|
@@ -7554,6 +7554,17 @@ |
|
|
skipAssert(assert); |
|
|
} |
|
|
}); |
|
|
|
|
|
QUnit.test('should not merge `Object.prototype` properties', function(assert) { |
|
|
assert.expect(1); |
|
|
|
|
|
_.merge({}, { 'constructor': { 'prototype': { 'a': 1 } } }); |
|
|
|
|
|
var actual = 'a' in objectProto; |
|
|
delete objectProto.a; |
|
|
|
|
|
assert.notOk(actual); |
|
|
}); |
|
|
}()); |
|
|
|
|
|
/*--------------------------------------------------------------------------*/ |
|
|