From 2b2f3ca0dfaff0cdec78214d24c45c4d16d46715 Mon Sep 17 00:00:00 2001
From: Jukka Kurkela <jukka.kurkela@gmail.com>
Date: Sun, 18 Oct 2020 21:01:11 +0300
Subject: [PATCH] Use Object.create(null) as `merge` target

---
 src/core/core.controller.js        | 8 ++++----
 src/core/core.datasetController.js | 2 +-
 src/core/core.scaleService.js      | 2 +-
 test/specs/helpers.core.tests.js   | 5 +++++
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/core/core.controller.js b/src/core/core.controller.js
index 98cffef2673..194c5aa5004 100644
--- a/src/core/core.controller.js
+++ b/src/core/core.controller.js
@@ -41,7 +41,7 @@ defaults._set('global', {
  * returns a deep copy of the result, thus doesn't alter inputs.
  */
 function mergeScaleConfig(/* config objects ... */) {
-	return helpers.merge({}, [].slice.call(arguments), {
+	return helpers.merge(Object.create(null), [].slice.call(arguments), {
 		merger: function(key, target, source, options) {
 			if (key === 'xAxes' || key === 'yAxes') {
 				var slen = source[key].length;
@@ -81,9 +81,9 @@ function mergeScaleConfig(/* config objects ... */) {
  * a deep copy of the result, thus doesn't alter inputs.
  */
 function mergeConfig(/* config objects ... */) {
-	return helpers.merge({}, [].slice.call(arguments), {
+	return helpers.merge(Object.create(null), [].slice.call(arguments), {
 		merger: function(key, target, source, options) {
-			var tval = target[key] || {};
+			var tval = target[key] || Object.create(null);
 			var sval = source[key];
 
 			if (key === 'scales') {
@@ -100,7 +100,7 @@ function mergeConfig(/* config objects ... */) {
 }
 
 function initConfig(config) {
-	config = config || {};
+	config = config || Object.create(null);
 
 	// Do NOT use mergeConfig for the data object because this method merges arrays
 	// and so would change references to labels and datasets, preventing data updates.
diff --git a/src/core/core.datasetController.js b/src/core/core.datasetController.js
index d17c7be0029..87e18aebe10 100644
--- a/src/core/core.datasetController.js
+++ b/src/core/core.datasetController.js
@@ -275,7 +275,7 @@ helpers.extend(DatasetController.prototype, {
 	 */
 	_configure: function() {
 		var me = this;
-		me._config = helpers.merge({}, [
+		me._config = helpers.merge(Object.create(null), [
 			me.chart.options.datasets[me._type],
 			me.getDataset(),
 		], {
diff --git a/src/core/core.scaleService.js b/src/core/core.scaleService.js
index fe945382003..31ab1d63c98 100644
--- a/src/core/core.scaleService.js
+++ b/src/core/core.scaleService.js
@@ -22,7 +22,7 @@ module.exports = {
 	},
 	getScaleDefaults: function(type) {
 		// Return the scale defaults merged with the global settings so that we always use the latest ones
-		return this.defaults.hasOwnProperty(type) ? helpers.merge({}, [defaults.scale, this.defaults[type]]) : {};
+		return this.defaults.hasOwnProperty(type) ? helpers.merge(Object.create(null), [defaults.scale, this.defaults[type]]) : {};
 	},
 	updateScaleDefaults: function(type, additions) {
 		var me = this;
diff --git a/test/specs/helpers.core.tests.js b/test/specs/helpers.core.tests.js
index d145bb21d0e..a6325736d78 100644
--- a/test/specs/helpers.core.tests.js
+++ b/test/specs/helpers.core.tests.js
@@ -265,6 +265,11 @@ describe('Chart.helpers.core', function() {
 	});
 
 	describe('clone', function() {
+		it('should not allow prototype pollution', function() {
+			var test = helpers.clone(JSON.parse('{"__proto__":{"polluted": true}}'));
+			expect(test.prototype).toBeUndefined();
+			expect(Object.prototype.polluted).toBeUndefined();
+		});
 		it('should clone primitive values', function() {
 			expect(helpers.clone()).toBe(undefined);
 			expect(helpers.clone(null)).toBe(null);