Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6ad6035

Browse files
committed
Fix prototype pollution
1 parent6fc27c2 commit6ad6035

File tree

6 files changed

+47
-7
lines changed

6 files changed

+47
-7
lines changed

‎LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
The MIT License (MIT)
22

3-
Copyright (c) 2014 yeikos - http://www.yeikos.com
3+
Copyright (c) 2014 yeikos
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎bower.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name":"merge",
3-
"version":"1.2.0",
3+
"version":"1.2.1",
44
"homepage":"https://github.com/yeikos/js.merge",
55
"authors": [
66
"yeikos <yeikos@gmail.com>"

‎merge.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*!
2-
*@name JavaScript/NodeJS Merge v1.2.0
2+
*@name JavaScript/NodeJS Merge v1.2.1
33
*@author yeikos
44
*@repository https://github.com/yeikos/js.merge
55
@@ -128,6 +128,8 @@
128128

129129
for(varkeyinitem){
130130

131+
if(key==='__proto__')continue;
132+
131133
varsitem=clone ?Public.clone(item[key]) :item[key];
132134

133135
if(recursive){

‎merge.min.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name":"merge",
3-
"version":"1.2.0",
4-
"author":"yeikos (http://www.yeikos.com)",
3+
"version":"1.2.1",
4+
"author":"yeikos",
55
"description":"Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.",
66
"main":"merge.js",
77
"license":"MIT",

‎tests/tests.js‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,25 @@ test('merge', function() {
5050

5151
});
5252

53+
test('merge (prototype pollution attack)',function(){
54+
55+
deepEqual(
56+
57+
merge({},JSON.parse('{"__proto__": {"a": true}}')),
58+
{}
59+
60+
);
61+
62+
deepEqual(
63+
64+
{}.a,
65+
66+
undefined
67+
68+
);
69+
70+
});
71+
5372
test('merge (clone)',function(){
5473

5574
varinput={
@@ -143,6 +162,25 @@ test('merge.recursive', function() {
143162

144163
});
145164

165+
test('merge.recursive (prototype pollution attack)',function(){
166+
167+
deepEqual(
168+
169+
merge.recursive({},JSON.parse('{"__proto__": {"a": true}}')),
170+
{}
171+
172+
);
173+
174+
deepEqual(
175+
176+
{}.a,
177+
178+
undefined
179+
180+
);
181+
182+
});
183+
146184
test('merge.recursive (clone)',function(){
147185

148186
varinput={a:{b:1}};

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp