From 709a262e2f895ed2501d38b9a6e920894fd578bf Mon Sep 17 00:00:00 2001 From: Alexander Fenster Date: Fri, 23 Jun 2023 14:38:07 -0700 Subject: [PATCH 1/2] fix: do not let setProperty change the prototype --- src/util.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util.js b/src/util.js index c39d33a6a..6c508990b 100644 --- a/src/util.js +++ b/src/util.js @@ -176,7 +176,7 @@ util.decorateEnum = function decorateEnum(object) { util.setProperty = function setProperty(dst, path, value) { function setProp(dst, path, value) { var part = path.shift(); - if (part === "__proto__") { + if (part === "__proto__" || part === "prototype") { return dst; } if (path.length > 0) { From 7eaa7d0414b110dcad0178f84d16081b9b04e4d6 Mon Sep 17 00:00:00 2001 From: Alexander Fenster Date: Fri, 23 Jun 2023 15:33:17 -0700 Subject: [PATCH 2/2] test: add unit test --- tests/api_util.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/api_util.js b/tests/api_util.js index 7b6f50ffe..63da0170f 100644 --- a/tests/api_util.js +++ b/tests/api_util.js @@ -95,6 +95,15 @@ tape.test("util", function(test) { util.setProperty(o, 'prop.subprop', { subsub2: 7}); test.same(o, {prop1: [5, 6], prop: {subprop: [{subsub: [5,6]}, {subsub2: 7}]}}, "should convert nested properties to array"); + + util.setProperty({}, "__proto__.test", "value"); + test.is({}.test, undefined); + + util.setProperty({}, "prototype.test", "value"); + test.is({}.test, undefined); + + util.setProperty({}, "constructor.prototype.test", "value"); + test.is({}.test, undefined); test.end(); });