test prototype pollution

mui · Oct 22, 2019 · a5a2d23 · a5a2d23
1 parent ad473f9
commit a5a2d23
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/packages/material-ui-utils/src/deepmerge.test.js b/packages/material-ui-utils/src/deepmerge.test.js
@@ -0,0 +1,10 @@
+import deepmerge from './deepmerge';
+import { expect } from 'chai';
+
+describe('deepmerge', () => {
+  // https://snyk.io/blog/after-three-years-of-silence-a-new-jquery-prototype-pollution-vulnerability-emerges-once-again/
+  it('should not be subject to prototype pollution', () => {
+    deepmerge({}, JSON.parse('{ "myProperty": "a", "__proto__" : { "isAdmin" : true } }'));
+    expect({}.isAdmin, undefined);
+  });
+});