Permalink
Browse files

Avoid merging properties on to __proto__ objects.

  • Loading branch information...
jdalton committed Jan 31, 2018
1 parent 5a3ff73 commit d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
Showing with 32 additions and 3 deletions.
  1. +17 −3 lodash.js
  2. +15 −0 test/test.js
@@ -1245,6 +1245,20 @@
return result;
}
/**
* Gets the value at `key`, unless `key` is "__proto__".
*
* @private
* @param {Object} object The object to query.
* @param {string} key The key of the property to get.
* @returns {*} Returns the property value.
*/
function safeGet(object, key) {
return key == '__proto__'
? undefined
: object[key];
}
/**
* Converts `set` to an array of its values.
*
@@ -3615,7 +3629,7 @@
}
else {
var newValue = customizer
? customizer(object[key], srcValue, (key + ''), object, source, stack)
? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
: undefined;
if (newValue === undefined) {
@@ -3642,8 +3656,8 @@
* counterparts.
*/
function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) {
var objValue = object[key],
srcValue = source[key],
var objValue = safeGet(object, key),
srcValue = safeGet(source, key),
stacked = stack.get(srcValue);
if (stacked) {
@@ -7539,6 +7539,21 @@
actual = _.groupBy([{ 'a': '__proto__' }], 'a');
assert.notOk(actual instanceof Array);
});
QUnit.test('should not merge "__proto__" properties', function(assert) {
assert.expect(1);
if (JSON) {
_.merge({}, JSON.parse('{"__proto__":{"a":1}}'));
var actual = "a" in objectProto;
delete objectProto.a;
assert.notOk(actual);
} else {
skipAssert(assert);
}
});
}());
/*--------------------------------------------------------------------------*/

0 comments on commit d8e069c

Please sign in to comment.