From b2f38cb706a4a1d9654d790c0bb8363deae38453 Mon Sep 17 00:00:00 2001
From: Jukka Kurkela <jukka.kurkela@gmail.com>
Date: Sun, 18 Oct 2020 21:05:05 +0300
Subject: [PATCH] Use Object.create(null) as `merge` target (#7920)

---
 src/core/core.controller.js      | 2 +-
 src/core/core.scaleService.js    | 2 +-
 test/specs/helpers.core.tests.js | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/core/core.controller.js b/src/core/core.controller.js
index fd199e0f29c..ef35a9cc4f8 100644
--- a/src/core/core.controller.js
+++ b/src/core/core.controller.js
@@ -22,7 +22,7 @@ module.exports = function(Chart) {
 	 * Initializes the given config with global and chart default values.
 	 */
 	function initConfig(config) {
-		config = config || {};
+		config = config || Object.create(null);
 
 		// Do NOT use configMerge() for the data object because this method merges arrays
 		// and so would change references to labels and datasets, preventing data updates.
diff --git a/src/core/core.scaleService.js b/src/core/core.scaleService.js
index 23cabe610d2..515933bc7d3 100644
--- a/src/core/core.scaleService.js
+++ b/src/core/core.scaleService.js
@@ -23,7 +23,7 @@ module.exports = function(Chart) {
 		},
 		getScaleDefaults: function(type) {
 			// Return the scale defaults merged with the global settings so that we always use the latest ones
-			return this.defaults.hasOwnProperty(type) ? helpers.merge({}, [defaults.scale, this.defaults[type]]) : {};
+			return this.defaults.hasOwnProperty(type) ? helpers.merge(Object.create(null), [defaults.scale, this.defaults[type]]) : {};
 		},
 		updateScaleDefaults: function(type, additions) {
 			var me = this;
diff --git a/test/specs/helpers.core.tests.js b/test/specs/helpers.core.tests.js
index 7efafd18bfd..0a653931d3b 100644
--- a/test/specs/helpers.core.tests.js
+++ b/test/specs/helpers.core.tests.js
@@ -238,6 +238,11 @@ describe('Chart.helpers.core', function() {
 	});
 
 	describe('clone', function() {
+		it('should not allow prototype pollution', function() {
+			var test = helpers.clone(JSON.parse('{"__proto__":{"polluted": true}}'));
+			expect(test.prototype).toBeUndefined();
+			expect(Object.prototype.polluted).toBeUndefined();
+		});
 		it('should clone primitive values', function() {
 			expect(helpers.clone()).toBe(undefined);
 			expect(helpers.clone(null)).toBe(null);