From 6da087bc6f23464bd7454d8286357886d62441af Mon Sep 17 00:00:00 2001
From: Evert Timberg <evert.timberg+github@gmail.com>
Date: Sun, 18 Oct 2020 13:38:24 -0400
Subject: [PATCH] Block bad keys in _mergerIf

---
 src/helpers/helpers.core.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/helpers/helpers.core.js b/src/helpers/helpers.core.js
index 852119fe824..8e16ee301c7 100644
--- a/src/helpers/helpers.core.js
+++ b/src/helpers/helpers.core.js
@@ -1,5 +1,9 @@
 'use strict';
 
+function isValidKey(key) {
+	return ['__proto__', 'prototype', 'constructor'].indexOf(key) === -1;
+}
+
 /**
  * @namespace Chart.helpers
  */
@@ -196,7 +200,7 @@ var helpers = {
 	 * @private
 	 */
 	_merger: function(key, target, source, options) {
-		if (['__proto__', 'prototype', 'constructor'].indexOf(key) !== -1) {
+		if (!isValidKey(key)) {
 			// We want to ensure we do not copy prototypes over
 			// as this can pollute global namespaces
 			return;
@@ -222,7 +226,7 @@ var helpers = {
 
 		if (helpers.isObject(tval) && helpers.isObject(sval)) {
 			helpers.mergeIf(tval, sval);
-		} else if (!target.hasOwnProperty(key)) {
+		} else if (!target.hasOwnProperty(key) && isValidKey(key)) {
 			target[key] = helpers.clone(sval);
 		}
 	},