Merge pull request #270 from 418sec/1-npm-mout

Security Fix for Prototype Pollution - huntr.dev
mout · Jul 15, 2021 · 3fecf13 · 3fecf13 · andrew-itscript · Aug 31, 2021
2 parents 2189378 + 397fa13
commit 3fecf13
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/object/set.js b/src/object/set.js
@@ -4,6 +4,10 @@ define(['./namespace'], function (namespace) {
      * set "nested" object property
      */
     function set(obj, prop, val){
+        // prototype pollution mitigation
+        if(prop.includes('__proto__') || prop.includes('prototype') || prop.includes('constructor')) {
+            return false;
+        }
         var parts = (/^(.+)\.(.+)$/).exec(prop);
         if (parts){
             namespace(obj, parts[1])[parts[2]] = val;