Fix prototype pollution

Following the approach in lodash#4759
Neumann-Nils · May 25, 2020 · 2f0047b · 2f0047b
1 parent 74b09d6
commit 2f0047b
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.internal/baseSet.js b/.internal/baseSet.js
@@ -30,6 +30,10 @@ function baseSet(object, path, value, customizer) {
     const key = toKey(path[index])
     let newValue = value
 
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      return object;
+    }
+
     if (index != lastIndex) {
       const objValue = nested[key]
       newValue = customizer ? customizer(objValue, key, nested) : undefined