think-config - npm Package Compare versions

Comparing version 1.1.2 to 1.1.3

index.js

@@ -48,2 +48,5 @@ const helper = require('think-helper');
     name = name.split('.');
+    if (name.some(item => /^__proto__|prototype|construcotr$/.test(item))) {
+      return this;
+    }
     const length = name.length;
@@ -50,0 +53,0 @@ name.forEach((item, index) => {

package.json

 {
   "name": "think-config",
   "description": "config for ThinkJS",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "author": {
@@ -6,0 +6,0 @@ "name": "welefen",

test/index.js

@@ -84,2 +84,8 @@ import test from 'ava';
 
+test('config set 7', t => {
+  const config = new Config({name: 2});
+  config.set('name.__proto__', 1234);
+  t.deepEqual(config.get('name.__proto__'), undefined);
+});
+
 test('getConfigFn 1', t => {
@@ -86,0 +92,0 @@ const fn = getConfigFn({name: 1}, false);

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

8979

increased by3.09%

Lines of code

229

increased by3.62%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes