Fix assignment to proto. Closes #34.

robinvdvleuten · Jan 11, 2021 · 513c084 · 513c084
1 parent 0377969
commit 513c084
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/index.js b/index.js
@@ -5,7 +5,7 @@ export function get (object, path, def) {
 };
 
 export function set  (object, path, val, obj) {
-  return ((path = path.split ? path.split('.') : path.slice(0)).slice(0, -1).reduce(function (obj, p) {
+  return !/__proto__/.test(path) && ((path = path.split ? path.split('.') : path.slice(0)).slice(0, -1).reduce(function (obj, p) {
     return obj[p] = obj[p] || {};
   }, obj = object)[path.pop()] = val), object;
 };
diff --git a/test.js b/test.js
@@ -73,6 +73,8 @@ cases('set({}, key, value)', ({ obj, key, value, expected }) => {
   "set(obj, 'a.b.c', 'bar')": { key: 'a.b.c', value: 'bar', expected: { a: { b: { c: 'bar' } } }, obj: { a: { b: { c: 'foo' } } } },
   "set(obj, 'a.b', 'foo')": { key: 'a.b', value: 'foo', expected: { a: { b: 'foo' } }, obj: { a: { b: undefined } } },
   "set(obj, 'a.b', undefined)": { key: 'a.b', value: undefined, expected: { a: { b: undefined } }, obj: { a: { b: 'foo' } } },
+  "set(obj, '__proto__', 'foo')": { key: "__proto__", value: "foo", expected: {} },
+  "set(obj, 'a.__proto__', 'foo')": { key: "__proto__", value: "foo", expected: { a: undefined } },
 });
 
 cases('set(undefined, key, value)', ({ obj, key, value }) => {