Security Fix for Prototype Pollution

Fix prototype pollution when path components are not strings
Vincit · Sep 15, 2021 · 46b842a · 46b842a
1 parent 260b284
commit 46b842a
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/lib/utils/objectUtils.js b/lib/utils/objectUtils.js
@@ -225,6 +225,9 @@ function set(obj, path, value) {
 
   for (let i = 0, l = path.length - 1; i < l; ++i) {
     const key = path[i];
+    if (key === '__proto__') {
+      return false;
+    }
     let child = obj[key];
 
     if (!isObject(child)) {
@@ -252,7 +255,10 @@ function set(obj, path, value) {
 function zipObject(keys, values) {
   const out = {};
 
-  for (let i = 0, l = keys.length; i < l; ++i) {
+  for (let i = 0, l = keys.length; i < l; ++i) {    
+    if (keys[i] === '__proto__') {
+      return false;
+    }
     out[keys[i]] = values[i];
   }