lil-fp - npm Package Compare versions

Comparing version 1.2.4 to 1.2.5

dist/index.d.ts

@@ -6,4 +6,4 @@ export { a as Arr } from './arr-baeb89ce.js';
 export { alt, match, otherwise, when } from './logic.js';
-export { o as Obj } from './obj-0f35c0db.js';
+export { o as Obj } from './obj-40a953aa.js';
 export { o as Opt } from './option-116b88b4.js';
 import './types.js';

dist/index.js

@@ -192,6 +192,12 @@ "use strict";
   ...obj
-}), get = (key, undef) => (obj) => {
-  let keys2 = key.split("."), i = 0;
-  for (; obj[keys2[i]]; )
-    obj = obj[keys2[i]], i++;
+}), isSafeKey = (key) => key !== "__proto__" && key !== "prototype" && key !== "constructor", get = (path, undef) => (obj) => {
+  let keys2 = Array.isArray(path) ? path : path.split(".");
+  for (let i = 0; i < keys2.length; i++) {
+    let key = keys2[i];
+    if (!obj || !Object.prototype.hasOwnProperty.call(obj, key) || !isSafeKey(key)) {
+      obj = void 0;
+      break;
+    }
+    obj = obj[key];
+  }
   return cast(obj ?? undef);
@@ -198,0 +204,0 @@ };

dist/obj.d.ts

 import './types.js';
-export { b as assign, c as assignTo, l as bind, h as clone, g as compact, n as defaults, e as entries, d as filter, a as from, f as fromEntries, q as get, k as keys, m as map, i as merge, j as omit, p as pick, s as split } from './obj-0f35c0db.js';
+export { b as assign, c as assignTo, l as bind, h as clone, g as compact, n as defaults, e as entries, d as filter, a as from, f as fromEntries, q as get, k as keys, m as map, i as merge, j as omit, p as pick, s as split } from './obj-40a953aa.js';

dist/obj.js

@@ -95,6 +95,12 @@ "use strict";
   ...obj
-}), get = (key, undef) => (obj) => {
-  let keys2 = key.split("."), i = 0;
-  for (; obj[keys2[i]]; )
-    obj = obj[keys2[i]], i++;
+}), isSafeKey = (key) => key !== "__proto__" && key !== "prototype" && key !== "constructor", get = (path, undef) => (obj) => {
+  let keys2 = Array.isArray(path) ? path : path.split(".");
+  for (let i = 0; i < keys2.length; i++) {
+    let key = keys2[i];
+    if (!obj || !Object.prototype.hasOwnProperty.call(obj, key) || !isSafeKey(key)) {
+      obj = void 0;
+      break;
+    }
+    obj = obj[key];
+  }
   return cast(obj ?? undef);
@@ -101,0 +107,0 @@ };

package.json

 {
   "name": "lil-fp",
-  "version": "1.2.4",
+  "version": "1.2.5",
   "description": "Functional programming utilities for TypeScript",
@@ -5,0 +5,0 @@ "main": "dist/index.js",

src/obj.ts

@@ -156,12 +156,23 @@ import { cast } from './func'
 
+const isSafeKey = (key: any) =>
+  key !== '__proto__' && key !== 'prototype' && key !== 'constructor'
+
 export const get =
-  <T extends Dict, K extends Path<T>>(key: K, undef?: T[K]) =>
+  <T extends Dict, K extends Path<T>>(path: K, undef?: T[K]) =>
   (obj: T): T[K] => {
-    let keys = key.split('.')
-    let i = 0
-    while (obj[keys[i]]) {
-      obj = obj[keys[i]]
-      i++
+    const keys = Array.isArray(path) ? path : path.split('.')
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i]
+      if (
+        !obj ||
+        !Object.prototype.hasOwnProperty.call(obj, key) ||
+        !isSafeKey(key)
+      ) {
+        // @ts-ignore
+        obj = undefined
+        break
+      }
+      obj = obj[key]
     }
     return cast(obj ?? undef)
   }

No alert changes

Improved metrics

Total package byte prevSize

71924

1.64%

Lines of code

2094

1.36%

No dependency changes