Skip to content
Permalink
Browse files
fix: prevent changes in prototype chain
  • Loading branch information
remy committed Feb 17, 2020
1 parent f495954 commit f272681b3a50e2c4cbb6a8533795e1453382c822
Showing 2 changed files with 15 additions and 0 deletions.
@@ -99,6 +99,10 @@ function undefsafe(obj, path, value, __res) {
return res;
}

if (Object.getOwnPropertyNames(obj).indexOf(key) == -1) {
return undefined;
}

obj = obj[key];
if (obj === undefined || obj === null) {
break;
@@ -0,0 +1,11 @@
var test = require('tap').test;
var undefsafe = require('../lib/undefsafe');

test('cannot modify prototype chain', function(t) {
const pre = {}.__proto__.toString;
var payload = '__proto__.toString';
undefsafe({ a: 'b' }, payload, 'JHU');
t.notEqual({}.toString, 'JHU');
({}.__proto__.toString = pre); // restore
t.end();
});

0 comments on commit f272681

Please sign in to comment.