Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Avoid merging properties on to __proto__ objects.
- Loading branch information
Showing
with
32 additions
and
3 deletions.
-
+17
−3
lodash.js
-
+15
−0
test/test.js
|
@@ -1245,6 +1245,20 @@ |
|
|
return result; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Gets the value at `key`, unless `key` is "__proto__". |
|
|
* |
|
|
* @private |
|
|
* @param {Object} object The object to query. |
|
|
* @param {string} key The key of the property to get. |
|
|
* @returns {*} Returns the property value. |
|
|
*/ |
|
|
function safeGet(object, key) { |
|
|
return key == '__proto__' |
|
|
? undefined |
|
|
: object[key]; |
|
|
} |
|
|
|
|
|
/** |
|
|
* Converts `set` to an array of its values. |
|
|
* |
|
@@ -3615,7 +3629,7 @@ |
|
|
} |
|
|
else { |
|
|
var newValue = customizer |
|
|
? customizer(object[key], srcValue, (key + ''), object, source, stack) |
|
|
? customizer(safeGet(object, key), srcValue, (key + ''), object, source, stack) |
|
|
: undefined; |
|
|
|
|
|
if (newValue === undefined) { |
|
@@ -3642,8 +3656,8 @@ |
|
|
* counterparts. |
|
|
*/ |
|
|
function baseMergeDeep(object, source, key, srcIndex, mergeFunc, customizer, stack) { |
|
|
var objValue = object[key], |
|
|
srcValue = source[key], |
|
|
var objValue = safeGet(object, key), |
|
|
srcValue = safeGet(source, key), |
|
|
stacked = stack.get(srcValue); |
|
|
|
|
|
if (stacked) { |
|
|
|
@@ -7539,6 +7539,21 @@ |
|
|
actual = _.groupBy([{ 'a': '__proto__' }], 'a'); |
|
|
assert.notOk(actual instanceof Array); |
|
|
}); |
|
|
|
|
|
QUnit.test('should not merge "__proto__" properties', function(assert) { |
|
|
assert.expect(1); |
|
|
|
|
|
if (JSON) { |
|
|
_.merge({}, JSON.parse('{"__proto__":{"a":1}}')); |
|
|
|
|
|
var actual = "a" in objectProto; |
|
|
delete objectProto.a; |
|
|
|
|
|
assert.notOk(actual); |
|
|
} else { |
|
|
skipAssert(assert); |
|
|
} |
|
|
}); |
|
|
}()); |
|
|
|
|
|
/*--------------------------------------------------------------------------*/ |
|
|