New build

Starcounter-Jack · Mar 24, 2022 · 8a6a360 · 8a6a360
1 parent adeb422
commit 8a6a360
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 7 deletions.
diff --git a/commonjs/duplex.js b/commonjs/duplex.js
@@ -1,7 +1,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 /*!
  * https://github.com/Starcounter-Jack/JSON-Patch
- * (c) 2017 Joachim Wester
+ * (c) 2017-2021 Joachim Wester
  * MIT license
  */
 var helpers_js_1 = require("./helpers.js");

diff --git a/dist/fast-json-patch.js b/dist/fast-json-patch.js
@@ -467,8 +467,10 @@ function applyOperation(document, operation, validateOperation, mutateDocument,
             if (key && key.indexOf('~') != -1) {
                 key = helpers_js_1.unescapePathComponent(key);
             }
-            if (banPrototypeModifications && key == '__proto__') {
-                throw new TypeError('JSON-Patch: modifying `__proto__` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README');
+            if (banPrototypeModifications &&
+                (key == '__proto__' ||
+                    (key == 'prototype' && t > 0 && keys[t - 1] == 'constructor'))) {
+                throw new TypeError('JSON-Patch: modifying `__proto__` or `constructor/prototype` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README');
             }
             if (validateOperation) {
                 if (existingPathFragment === undefined) {
@@ -742,7 +744,7 @@ exports.unescapePathComponent = helpers.unescapePathComponent;
 Object.defineProperty(exports, "__esModule", { value: true });
 /*!
  * https://github.com/Starcounter-Jack/JSON-Patch
- * (c) 2017 Joachim Wester
+ * (c) 2017-2021 Joachim Wester
  * MIT license
  */
 var helpers_js_1 = __webpack_require__(0);