Merge pull request #1 from zpbrent/patch-1

Security Fix for Prototype Pollution in mquery
mongoosejs · Mar 29, 2021 · d3b230b · d3b230b
2 parents 34344fa + a7b6d7c
commit d3b230b
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/utils.js b/lib/utils.js
@@ -170,6 +170,9 @@ exports.mergeClone = function mergeClone(to, from) {
 
   while (i--) {
     key = keys[i];
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     if ('undefined' === typeof to[key]) {
       to[key] = clone(from[key]);
     } else {