Merge pull request #2 from alromh87/enhancePR

Fix Prototype Pollution
418sec · Oct 22, 2020 · c397b6f · c397b6f
2 parents 2ad6af4 + 7d88fd2
commit c397b6f
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/core.ts b/src/core.ts
@@ -247,9 +247,11 @@ export function applyOperation<T>(document: T, operation: Operation, validateOpe
     }
     while (true) {
       key = keys[t];
-
-      if(banPrototypeModifications && key == '__proto__') {
-        throw new TypeError('JSON-Patch: modifying `__proto__` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README');
+      if(banPrototypeModifications && 
+          (key == '__proto__' || 
+          (key == 'prototype' && t>0 && keys[t-1] == 'constructor'))
+        ) {
+        throw new TypeError('JSON-Patch: modifying `__proto__` or `constructor/prototype` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README');
       }
 
       if (validateOperation) {