New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature/set #2961
base: master
Are you sure you want to change the base?
Feature/set #2961
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
import isObject from './isObject.js'; | ||
import toPath from './_toPath.js'; | ||
import contains from './contains.js'; | ||
|
||
|
||
var arrayIndex = /^\d+$/; | ||
|
||
// Internal function of `set`. | ||
function deepSet(obj, path, value) { | ||
var key = path[0]; | ||
|
||
if (path.length === 1) { | ||
obj[key] = value; | ||
return; | ||
} | ||
|
||
if (!isObject(obj[key])) { | ||
var nextKey = path[1]; | ||
obj[key] = arrayIndex.test(nextKey) ? [] : {}; | ||
} | ||
|
||
return deepSet(obj[key], path.slice(1), value); | ||
} | ||
|
||
// Set the value on `path` of `object`. | ||
// If any property in `path` does not exist it will be created. | ||
// Returns mutated object (`obj`). | ||
export default function set(obj, path, value) { | ||
path = toPath(path); | ||
|
||
if (!isObject(obj) || !path.length) return obj; | ||
if (contains(path, '__proto__')) throw new Error('Prototype assignment attempted'); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Two things. Firstly, I'm in favor of reusing our own function in principle. However, in this case the use of Secondly, I just realized we need to check not only for |
||
|
||
deepSet(obj, path, value); | ||
|
||
return obj; | ||
} |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Large diffs are not rendered by default.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is the right place to check that
key
is not one of'__proto__'
,'constructor'
or'prototype'
.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm afraid it will mutate before throwing an error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I realized that as well. I can think of three options (from least to most preferred, in my opinion):
_.contains
, accept the double iteration and the greater weight after treeshaking.obj
gets somewhat corrupted. At least the prototype pollution attempt is detected and unsuccessful.I didn't mention it because I was ready to accept option 2, but I would prefer option 3.