plain-object-merge - npm Package Compare versions

Comparing version 1.0.1 to 1.0.2

dist/index.js

@@ -15,2 +15,4 @@ "use strict";
     for (var key in source) {
+        if (key === 'constructor' || key === 'prototype' || key === '__proto__')
+            continue;
         var value = source[key];
@@ -17,0 +19,0 @@ if (isPrimitive(value)) {

package.json

 {
   "name": "plain-object-merge",
   "description": "Extremely fast function optimized for deep merging json-serializable plain objects.",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "main": "dist/index.js",
@@ -6,0 +6,0 @@ "types": "dist/index.d.ts",

src/index.ts

@@ -27,2 +27,4 @@
 
+    if ( key === 'constructor' || key === 'prototype' || key === '__proto__' ) continue;
+
     const value = source[key];
@@ -29,0 +31,0 @@

test/index.js

@@ -28,2 +28,12 @@
 
+  it ( 'is not succeptible to prototype pollution issues', t => {
+
+    t.deepEqual ( merge ([ {}, { foo: 1, constructor: 2, bar: 3 } ]), { foo: 1, bar: 3 } );
+
+    t.deepEqual ( merge ([ {}, { foo: 1, prototype: 2, bar: 3 } ]), { foo: 1, bar: 3 } );
+
+    t.deepEqual ( merge ([ {}, { foo: 1, __proto__: 2, bar: 3 } ]), { foo: 1, bar: 3 } );
+
+  });
+
 });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

8716

increased by6.63%

Lines of code

210

increased by3.96%

No dependency changes