Skip to content
Permalink
Browse files Browse the repository at this point in the history
Avoid merging properties on to __proto__ objects.
  • Loading branch information
jdalton committed Jan 31, 2018
1 parent 5a3ff73 commit d8e069c
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 3 deletions.
20 changes: 17 additions & 3 deletions lodash.js
Expand Up @@ -1245,6 +1245,20 @@
return result;
}

/**
* Gets the value at `key`, unless `key` is "__proto__".
*
* @private
* @param {Object} object The object to query.
* @param {string} key The key of the property to get.
* @returns {*} Returns the property value.
*/
function safeGet(object, key) {
return key == '__proto__'
? undefined
: object[key];
}

/**
* Converts `set` to an array of its values.
*
Expand Down Expand Up @@ -3615,7 +3629,7 @@
}
else {
var newValue = customizer
? customizer(object[key], srcValue, (key + ''), object, source, stack)
? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack)
: undefined;

if (newValue === undefined) {
Expand All @@ -3642,8 +3656,8 @@
* counterparts.
*/
function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) {
var objValue = object[key],
srcValue = source[key],
var objValue = safeGet(object, key),
srcValue = safeGet(source, key),
stacked = stack.get(srcValue);

if (stacked) {
Expand Down
15 changes: 15 additions & 0 deletions test/test.js
Expand Up @@ -7539,6 +7539,21 @@
actual = _.groupBy([{ 'a': '__proto__' }], 'a');
assert.notOk(actual instanceof Array);
});

QUnit.test('should not merge "__proto__" properties', function(assert) {
assert.expect(1);

if (JSON) {
_.merge({}, JSON.parse('{"__proto__":{"a":1}}'));

var actual = "a" in objectProto;
delete objectProto.a;

assert.notOk(actual);
} else {
skipAssert(assert);
}
});
}());

/*--------------------------------------------------------------------------*/
Expand Down

0 comments on commit d8e069c

Please sign in to comment.