Merge pull request #121 from 418sec/1-npm-mquery

Security Fix for Prototype Pollution - huntr.dev
mongoosejs · Mar 29, 2021 · 158f059 · 158f059
2 parents 34344fa + d3b230b
commit 158f059
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/utils.js b/lib/utils.js
@@ -170,6 +170,9 @@ exports.mergeClone = function mergeClone(to, from) {
 
   while (i--) {
     key = keys[i];
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     if ('undefined' === typeof to[key]) {
       to[key] = clone(from[key]);
     } else {