Fix Prototype Pollution

pierreinglebert · Oct 13, 2020 · 67ad7dd · 67ad7dd
1 parent f3d6c8e
commit 67ad7dd
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/apply.js b/lib/apply.js
@@ -15,6 +15,9 @@ module.exports = function apply(target, patch) {
   var keys = Object.keys(patch);
   for (var i = 0; i < keys.length; i++) {
     var key = keys[i];
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      return target;
+    }
     if (patch[key] === null) {
       if (target.hasOwnProperty(key)) {
         delete target[key];