CVE-2021-4307: Security Fix for Prototype Pollution (#511) · Yomguithereal/baobab@c566395

Permalink

Browse files

Security Fix for Prototype Pollution (#511)

• Loading branch information

huntr.dev | the place to protect open source committed

Jan 26, 2021

1 parent 9725f5e commit c56639532a923d9a1600fb863ec7551b188b5d19

Showing 2 changed files with 10 additions and 1 deletion.

• • helpers.js
• • helpers.ts

@@ -444,7 +444,8 @@ function merger(deep, …objects) {

for (k in t) {

if (deep &&

type.object(t[k]) &&

!(t[k] instanceof Monkey)) {

!(t[k] instanceof Monkey) &&

!(k === ‘__proto__’ || k === ‘constructor’ || k === ‘prototype’)) {

o[k] = merger(true, o[k] || {}, t[k]);

}

else {

@@ -94,6 +94,14 @@ describe('Helpers’, function() {

{one: {two: [3, 4]}, three: 3}

);

});

it('merge should not pollute object prototype.’, function() {

const data = JSON.parse(‘{"__proto__": {"polluted": true}}’);

deepMerge({}, data);

assert.equal(Object.keys(Object.prototype).includes(‘polluted’), false);

});

});

/**

0 comments on commit c566395

Please sign in to comment.