Comparing version 1.0.0 to 1.0.1
@@ -15,2 +15,6 @@ var typeOf = require('./typeof'), | ||
function getProp(obj, p) { | ||
return p === '__proto__' ? undefined : obj[p]; | ||
} | ||
function clone(val) { | ||
@@ -58,3 +62,3 @@ switch(typeOf(val)) { | ||
Object.keys(b).forEach(function(p) { | ||
if(typeOf(b[p]) === 'object' && typeOf(a[p]) === 'object') | ||
if(typeOf(getProp(b, p)) === 'object' && typeOf(a[p]) === 'object') | ||
deepExtend(a[p], b[p]); | ||
@@ -113,3 +117,3 @@ else | ||
ap = a[p]; | ||
bp = b[p]; | ||
bp = getProp(b, p); | ||
ta = typeOf(ap); | ||
@@ -116,0 +120,0 @@ tb = typeOf(bp); |
{ | ||
"name": "deap", | ||
"version": "1.0.0", | ||
"version": "1.0.1", | ||
"description": "extend and merge objects, deep or shallow", | ||
@@ -5,0 +5,0 @@ "main": "index.js", |
@@ -67,3 +67,3 @@ [![Build Status](https://travis-ci.org/selfcontained/deap.svg?branch=master)](https://travis-ci.org/selfcontained/deap) | ||
Deep update. Fill an object's existing properties from another object. | ||
Deep update. Fill an object's existing properties from another object. For nested objects, a deep update will only update existing properties. Shallow updates will replace nested objects entirely. | ||
@@ -70,0 +70,0 @@ Takes *n* number of arguments, modifies the first argument and returns it. |
@@ -155,2 +155,13 @@ var assert = require('chai').assert, | ||
// Vulnerability reported via hacker1: https://hackerone.com/reports/310446 | ||
it('should not modify Object prototype (hacker1 #310446)', function() { | ||
var a = { foo: 'bar' }, | ||
b = JSON.parse('{ "__proto__": { "evilBad": "DANGER!!!" } }'); | ||
var result = deepExtend(a, b); | ||
assert.isUndefined({}.evilBad); | ||
assert.isUndefined(Object.prototype.evilBad); | ||
}); | ||
}); |
@@ -134,2 +134,12 @@ var lib = require('../lib/deap'), | ||
// Vulnerability reported via hacker1: https://hackerone.com/reports/310446 | ||
it('should not modify Object prototype (hacker1 #310446)', function() { | ||
var a = { foo: 'bar' }, | ||
b = JSON.parse('{ "__proto__": { "evilBad": "DANGER!!!" } }'); | ||
var result = deepMerge(a, b); | ||
assert.isUndefined({}.evilBad); | ||
assert.isUndefined(Object.prototype.evilBad); | ||
}); | ||
}); |
@@ -33,2 +33,22 @@ var lib = require('../lib/deap'), | ||
it('should replace a top level property with an multi-level object', function() { | ||
var a = { burp: 'adurp' }, | ||
b = { burp: { foo: 'bar', biz: { baz: 'buz', zing: 'zoing' } } }; | ||
var result = shallowUpdate(a, b); | ||
assert.deepEqual(result, a); | ||
assert.deepEqual(result.burp, b.burp); | ||
}); | ||
it('should replace a top level object with a string', function() { | ||
var a = { burp: { foo: 'bar' } }, | ||
b = { burp: 'adurp' }; | ||
var result = shallowUpdate(a, b); | ||
assert.deepEqual(result, a); | ||
assert.deepEqual(result.burp, b.burp); | ||
}); | ||
}); | ||
@@ -137,2 +157,13 @@ | ||
it('should only replace existing properties in nested objects', function() { | ||
var a = { burp: { thing: 'thang', biz: { burp: 'adurp' } } }, | ||
b = { burp: { foo: 'bar', biz: { burp: 'boop', baz: 'buz', zing: 'zoing' } } }; | ||
var result = deepUpdate(a, b); | ||
assert.deepEqual(result, a); | ||
assert.deepEqual(result.burp.thing, 'thang'); | ||
assert.deepEqual(result.burp.biz.burp, 'boop'); | ||
}); | ||
}); |
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
30073
735
14
1