convict - npm Package Compare versions

Comparing version 6.2.2 to 6.2.3

package.json

@@ -20,3 +20,3 @@ {
   ],
-  "version": "6.2.2",
+  "version": "6.2.3",
   "license": "Apache-2.0",
@@ -40,3 +40,3 @@ "homepage": "https://github.com/mozilla/node-convict",
   },
-  "gitHead": "4da12f88f77a3a4c1d61fee3bc5d16194892802d"
+  "gitHead": "deef5d77f4f6a714579387c2d67a051396477415"
 }

src/main.js

@@ -14,4 +14,4 @@ /**
 const FORBIDDEN_KEY_PATHS = [
-  '__proto__',
-  'this.constructor.prototype',
+  '__proto__.',
+  'this.constructor.prototype.',
 ]
@@ -571,4 +571,5 @@
     set: function(k, v) {
-      for (const path of FORBIDDEN_KEY_PATHS) {
-        if (k.startsWith(`${path}.`)) {
+      for (const forbidden_key_path of FORBIDDEN_KEY_PATHS) {
+        if (k.startsWith(forbidden_key_path) ||
+            k.includes(`.${forbidden_key_path}`)) {
           return this
@@ -575,0 +576,0 @@ }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

41667

increased by0.18%

Lines of code

686

increased by0.15%

No dependency changes