Skip to content

Commit ec358de

Browse files
committed
fix(core): fixed __proto__ pollution
1 parent c19ecaf commit ec358de

File tree

5 files changed

+52
-39
lines changed

5 files changed

+52
-39
lines changed

src/angular/src/utils/utils.ts

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,23 @@ export function isObject(o) {
88
}
99

1010
export function extend(target, src) {
11-
Object.keys(src).forEach((key) => {
12-
if (typeof target[key] === 'undefined') {
13-
target[key] = src[key];
14-
return;
15-
}
16-
if (target[key] && !src[key]) {
17-
return;
18-
}
19-
if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
20-
extend(target[key], src[key]);
21-
} else {
22-
target[key] = src[key];
23-
}
24-
});
11+
const noExtend = ['__proto__', 'constructor', 'prototype'];
12+
Object.keys(src)
13+
.filter((key) => noExtend.indexOf(key) < 0)
14+
.forEach((key) => {
15+
if (typeof target[key] === 'undefined') {
16+
target[key] = src[key];
17+
return;
18+
}
19+
if (target[key] && !src[key]) {
20+
return;
21+
}
22+
if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
23+
extend(target[key], src[key]);
24+
} else {
25+
target[key] = src[key];
26+
}
27+
});
2528
}
2629

2730
export function coerceBooleanProperty(value: any): boolean {

src/react/utils.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@ function isObject(o) {
88
}
99

1010
function extend(target, src) {
11-
Object.keys(src).forEach((key) => {
12-
if (typeof target[key] === 'undefined') target[key] = src[key];
13-
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
14-
extend(target[key], src[key]);
15-
} else {
16-
target[key] = src[key];
17-
}
18-
});
11+
const noExtend = ['__proto__', 'constructor', 'prototype'];
12+
Object.keys(src)
13+
.filter((key) => noExtend.indexOf(key) < 0)
14+
.forEach((key) => {
15+
if (typeof target[key] === 'undefined') target[key] = src[key];
16+
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
17+
extend(target[key], src[key]);
18+
} else {
19+
target[key] = src[key];
20+
}
21+
});
1922
}
2023

2124
function needsNavigation(params = {}) {

src/svelte/utils.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@ function isObject(o) {
88
}
99

1010
function extend(target, src) {
11-
Object.keys(src).forEach((key) => {
12-
if (typeof target[key] === 'undefined') target[key] = src[key];
13-
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
14-
extend(target[key], src[key]);
15-
} else {
16-
target[key] = src[key];
17-
}
18-
});
11+
const noExtend = ['__proto__', 'constructor', 'prototype'];
12+
Object.keys(src)
13+
.filter((key) => noExtend.indexOf(key) < 0)
14+
.forEach((key) => {
15+
if (typeof target[key] === 'undefined') target[key] = src[key];
16+
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
17+
extend(target[key], src[key]);
18+
} else {
19+
target[key] = src[key];
20+
}
21+
});
1922
}
2023

2124
function needsNavigation(params = {}) {

src/utils/utils.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,10 +94,11 @@ function isObject(o) {
9494
}
9595
function extend(...args) {
9696
const to = Object(args[0]);
97+
const noExtend = ['__proto__', 'constructor', 'prototype'];
9798
for (let i = 1; i < args.length; i += 1) {
9899
const nextSource = args[i];
99100
if (nextSource !== undefined && nextSource !== null) {
100-
const keysArray = Object.keys(Object(nextSource)).filter((key) => key !== '__proto__');
101+
const keysArray = Object.keys(Object(nextSource)).filter((key) => noExtend.indexOf(key) < 0);
101102
for (let nextIndex = 0, len = keysArray.length; nextIndex < len; nextIndex += 1) {
102103
const nextKey = keysArray[nextIndex];
103104
const desc = Object.getOwnPropertyDescriptor(nextSource, nextKey);

src/vue/utils.js

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@ function isObject(o) {
88
}
99

1010
function extend(target, src) {
11-
Object.keys(src).forEach((key) => {
12-
if (typeof target[key] === 'undefined') target[key] = src[key];
13-
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
14-
extend(target[key], src[key]);
15-
} else {
16-
target[key] = src[key];
17-
}
18-
});
11+
const noExtend = ['__proto__', 'constructor', 'prototype'];
12+
Object.keys(src)
13+
.filter((key) => noExtend.indexOf(key) < 0)
14+
.forEach((key) => {
15+
if (typeof target[key] === 'undefined') target[key] = src[key];
16+
else if (isObject(src[key]) && isObject(target[key]) && Object.keys(src[key]).length > 0) {
17+
extend(target[key], src[key]);
18+
} else {
19+
target[key] = src[key];
20+
}
21+
});
1922
}
2023

2124
function needsNavigation(props = {}) {

0 commit comments

Comments
 (0)