libnested - npm Package Compare versions

Comparing version 1.5.1 to 1.5.2

index.js

@@ -25,3 +25,6 @@ function isObject (o, allowArray) {
   if(isBasic(path)) return obj[path] = value
-  for(var i = 0; i < path.length; i++)
+  for(var i = 0; i < path.length; i++) {
+    if (isPrototypePolluted(path[i]))
+      continue
+
     if(i === path.length - 1)
@@ -31,4 +34,5 @@ obj[path[i]] = value
       obj = (obj[path[i]] = isNonNegativeInteger(path[i+1]) ? [] : {})
-    else if (!(isPrototypePolluted(path[i])))
+    else
       obj = obj[path[i]]
+  }
   return value
@@ -97,3 +101,3 @@ }
 function isPrototypePolluted(key) {
-  return ['__proto__', 'constructor', 'prototype'].includes(key)
+  return ['__proto__', 'constructor', 'prototype'].includes(key.toString())
 }
@@ -100,0 +104,0 @@

package.json

 {
   "name": "libnested",
   "description": "",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "homepage": "https://github.com/dominictarr/libnested",
@@ -6,0 +6,0 @@ "repository": {

test.js

@@ -154,1 +154,12 @@
 })
+
+tape('prototype pollution', function (t) {
+  t.notEqual({}.polluted, 'yes')
+  R.set({}, ['__proto__','polluted'], 'yes');
+  t.notEqual({}.polluted, 'yes')
+  R.set({}, [['__proto__'], 'polluted'], 'yes')
+  t.notEqual({}.polluted, 'yes')
+  R.set({}, [['constructor', 'prototype'], 'polluted'], 'yes')
+  t.notEqual({}.polluted, 'yes')
+  t.end()
+})

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

8858

increased by4.48%

Lines of code

229

increased by6.02%

No dependency changes