xtend - npm Package Compare versions

Comparing version 4.0.1 to 4.0.2

package.json

 {
   "name": "xtend",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "extend like a boss",
@@ -5,0 +5,0 @@ "keywords": [

README.md

@@ -19,3 +19,3 @@ # xtend
     a: "a",
-    b: 'c'
+    b: "c"
 }, {
@@ -29,3 +29,3 @@ b: "b"
 
-## MIT Licenced
+## MIT Licensed 
 
@@ -32,0 +32,0 @@

test.js

@@ -84,1 +84,21 @@ var test = require("tape")
 })
+
+test("prototype pollution", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    extend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})
+
+test("prototype pollution mutable", function (assert) {
+    var a = {}
+    var maliciousPayload = '{"__proto__":{"oops":"It works!"}}'
+
+    assert.strictEqual(a.oops, undefined)
+    mutableExtend({}, maliciousPayload)
+    assert.strictEqual(a.oops, undefined)
+    assert.end()
+})

No alert changes

Improved metrics

Total package byte prevSize

6465

increased by8.53%

Lines of code

106

increased by17.78%

Worsened metrics

Number of package files

7

decreased by-22.22%

No dependency changes