|
7555 | 7555 | } |
7556 | 7556 | }); |
7557 | 7557 |
|
7558 | | - QUnit.test('should not merge `Object.prototype` properties', function(assert) { |
7559 | | - assert.expect(1); |
| 7558 | + QUnit.test('should not indirectly merge builtin prototype properties', function(assert) { |
| 7559 | + assert.expect(2); |
| 7560 | + |
| 7561 | + _.merge({}, { 'toString': { 'constructor': { 'prototype': { 'a': 1 } } } }); |
| 7562 | + |
| 7563 | + var actual = 'a' in funcProto; |
| 7564 | + delete funcProto.a; |
| 7565 | + |
| 7566 | + assert.notOk(actual); |
7560 | 7567 |
|
7561 | 7568 | _.merge({}, { 'constructor': { 'prototype': { 'a': 1 } } }); |
7562 | 7569 |
|
7563 | | -varactual = 'a' in objectProto; |
| 7570 | + actual = 'a' in objectProto; |
7564 | 7571 | delete objectProto.a; |
7565 | 7572 |
|
7566 | 7573 | assert.notOk(actual); |
7567 | 7574 | }); |
| 7575 | + |
| 7576 | + QUnit.test('should not indirectly merge `Object` properties', function(assert) { |
| 7577 | + assert.expect(1); |
| 7578 | + |
| 7579 | + _.merge({}, { 'constructor': { 'a': 1 } }); |
| 7580 | + |
| 7581 | + var actual = 'a' in Object; |
| 7582 | + delete Object.a; |
| 7583 | + |
| 7584 | + assert.notOk(actual); |
| 7585 | + }); |
7568 | 7586 | }()); |
7569 | 7587 |
|
7570 | 7588 | /*--------------------------------------------------------------------------*/ |
|