express-fileupload - npm Package Compare versions

Comparing version 1.1.8 to 1.1.9

lib/processNested.js

@@ -1,2 +0,2 @@
-const INVALID_KEYS = ['__proto__'];
+const INVALID_KEYS = ['__proto__', 'constructor'];
 
@@ -3,0 +3,0 @@ module.exports = function(data){

package.json

 {
   "name": "express-fileupload",
-  "version": "1.1.8",
+  "version": "1.1.9",
   "author": "Richard Girges <[e-mail]>",
@@ -5,0 +5,0 @@ "description": "Simple express file upload middleware that wraps around Busboy",

test/processNested.spec.js

@@ -50,9 +50,11 @@ 'use strict';
   it('Do not allow prototype pollution', () => {
-    const pollutionOb = JSON.parse(`{"__proto__.POLLUTED": "FOOBAR"}`);
+    const pollutionOb1 = JSON.parse(`{"__proto__.POLLUTED1": "FOOBAR"}`);
+    const pollutionOb2 = JSON.parse(`{"constructor.prototype.POLLUTED2": "FOOBAR"}`);
 
-    processNested(pollutionOb);
+    processNested(pollutionOb1);
+    processNested(pollutionOb2);
 
-    // eslint-disable-next-line no-undef
-    assert.equal(global.POLLUTED, undefined);
+    assert.equal(global.POLLUTED1, undefined);
+    assert.equal(global.POLLUTED2, undefined);
   });
 });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1212671

increased by0.01%

Lines of code

2244

increased by0.09%

No dependency changes