Prevent prototype pollution reported in issue #4

brycebaril · Dec 21, 2023 · 27d569b · 27d569b
1 parent b7d97ec
commit 27d569b
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 0 deletions.
diff --git a/flatten.js b/flatten.js
@@ -1,3 +1,5 @@
+'use strict'
+
 module.exports = flatten
 
 function flatten(obj) {

diff --git a/nest.js b/nest.js
@@ -1,3 +1,5 @@
+'use strict'
+
 module.exports = nest
 
 var seek = require("./seek")
@@ -37,6 +39,8 @@ function insert(target, path, value) {
   var len = pathBits.length
   for (var i = 0; i < len; i += 2) {
     var key = pathBits[i]
+    if (key === "__proto__") continue
+    if (key === "constructor" && typeof target[key] == "function") continue
     var type = pathBits[i + 1]
 
     if (type == null && key) parent[key] = value

diff --git a/seek.js b/seek.js
@@ -1,3 +1,5 @@
+'use strict'
+
 module.exports = seek
 
 var nestedRe = /(\.|\[)/

diff --git a/test/flatten.js b/test/flatten.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var test = require("tape").test
 
 var flatten = require("../flatten")

diff --git a/test/nest.js b/test/nest.js
@@ -1,3 +1,5 @@
+'use strict'
+
 var test = require("tape").test
 
 var nest = require("../nest")
@@ -139,3 +141,11 @@ test("nest empty", function (t) {
   t.deepEquals(nest(struct), expect, "empty object is still empty")
   t.end()
 })
+
+test("no prototype pollution", function (t) {
+  nest({'constructor.prototype.fail': true})
+  nest({'__proto__.bad': true})
+  t.false({}.fail, "constructor.prototype not polluted")
+  t.false({}.bad, "__proto__ not polluted")
+  t.end()
+})