Avoid merging properties on to __proto__ objects.

lodash.js

@@ -1245,6 +1245,20 @@
    return result;
  }

  /**
   * Gets the value at `key`, unless `key` is "__proto__".
   *
   * @private
   * @param {Object} object The object to query.
   * @param {string} key The key of the property to get.
   * @returns {*} Returns the property value.
   */
  function safeGet(object, key) {
    return key == '__proto__'
      ? undefined
      : object[key];
  }

  /**
   * Converts `set` to an array of its values.
   *
@@ -3615,7 +3629,7 @@
        }
        else {
          var newValue = customizer
            ? customizer(object[key], srcValue, (key + ''), object, source, stack)
            ? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
            : undefined;

          if (newValue === undefined) {
@@ -3642,8 +3656,8 @@
     *  counterparts.
     */
    function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) {
      var objValue = object[key],
          srcValue = source[key],
      var objValue = safeGet(object, key),
          srcValue = safeGet(source, key),
          stacked = stack.get(srcValue);

      if (stacked) {

test/test.js

@@ -7539,6 +7539,21 @@
      actual = _.groupBy([{ 'a': '__proto__' }], 'a');
      assert.notOk(actual instanceof Array);
    });

    QUnit.test('should not merge "__proto__" properties', function(assert) {
      assert.expect(1);

      if (JSON) {
        _.merge({}, JSON.parse('{"__proto__":{"a":1}}'));

        var actual = "a" in objectProto;
        delete objectProto.a;

        assert.notOk(actual);
      } else {
        skipAssert(assert);
      }
    });
  }());

  /*--------------------------------------------------------------------------*/