catbox - npm Package Compare versions

Comparing version 4.2.0 to 4.2.1

lib/policy.js

@@ -45,8 +45,9 @@ // Load modules
     var id = (key && typeof key === 'object') ? key.id : key;
-    if (this._pendings[id]) {
-        this._pendings[id].push(callback);
+    var pendingsId = '+' + id;                                  // Prefix to avoid conflicts with JS internals (e.g. __proto__)
+    if (this._pendings[pendingsId]) {
+        this._pendings[pendingsId].push(callback);
         return;
     }
 
-    this._pendings[id] = [callback];
+    this._pendings[pendingsId] = [callback];
 
@@ -173,2 +174,3 @@ // Lookup in cache
 
+    id = '+' + id;
     var pendings = this._pendings[id];
@@ -175,0 +177,0 @@ delete this._pendings[id];

package.json

 {
   "name": "catbox",
   "description": "Multi-strategy object caching service",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "repository": "git://github.com/hapijs/catbox",
@@ -16,3 +16,3 @@ "main": "index",
     "hoek": "2.x.x",
-    "joi":  "4.x.x"
+    "joi":  "5.x.x"
   },
@@ -19,0 +19,0 @@ "devDependencies": {

test/policy.js

@@ -47,2 +47,25 @@ // Load modules
 
+    it('works with special property names', function (done) {
+
+        var client = new Catbox.Client(Import);
+        var policy = new Catbox.Policy({ expiresIn: 1000 }, client, 'test');
+
+        client.start(function (err) {
+
+            expect(err).to.not.exist();
+
+            policy.set('__proto__', '123', null, function (err) {
+
+                expect(err).to.not.exist();
+
+                policy.get('__proto__', function (err, value, cached, report) {
+
+                    expect(err).to.not.exist();
+                    expect(value).to.equal('123');
+                    done();
+                });
+            });
+        });
+    });
+
     it('finds nothing when using empty policy rules', function (done) {
@@ -49,0 +72,0 @@

No alert changes

Improved metrics

Total package byte prevSize

156468

increased by0.52%

Lines of code

2301

increased by0.74%

Dependency changes

• + Addedjoi@5.1.0(transitive)

• - Removedjoi@4.9.0(transitive)

• Updatedjoi@5.x.x