Merge pull request #1 from arjunshibu/master

Security fix for Prototype Pollution vulnerability
ssnau · Apr 17, 2021 · 7f6c760 · 7f6c760
2 parents ec154c9 + 8f911ab
commit 7f6c760
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/util/set-path-value.js b/src/util/set-path-value.js
@@ -4,7 +4,7 @@ module.exports = function setPathValue(obj, path, value) {
   let state = obj;
   const last = paths[paths.length - 1];
   for (let i = 0; i < paths.length - 1; i++) {
-    state = state && state[paths[i]];
+    state = state && state[paths[i]] !== Object.prototype && state[paths[i]];
   }
   if (!state) return false;
   if (value !== state[last]) {

diff --git a/util/set-path-value.js b/util/set-path-value.js
@@ -4,7 +4,7 @@ module.exports = function setPathValue(obj, path, value) {
   var state = obj;
   var last = paths[paths.length - 1];
   for (var i = 0; i < paths.length - 1; i++) {
-    state = state && state[paths[i]];
+    state = state && state[paths[i]] !== Object.prototype && state[paths[i]];
   }
   if (!state) { return false; }
   if (value !== state[last]) {