Security fix for Prototype Pollution (#20)

Co-authored-by: Arjun Shibu <[email protected]> Co-authored-by: Jamie Slome <[email protected]> Co-authored-by: Shawn <[email protected]>
BadOPCode · Nov 11, 2021 · b9cc2b3 · b9cc2b3
1 parent 78f4ffa
commit b9cc2b3
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/Merge.ts b/src/Merge.ts
@@ -47,13 +47,18 @@ const  handleDefaultBehavior = (originalObject: any, newObject: any, behavior?:
     if (originalTypeName === "Object" && newTypeName === "Object") { // built-in behavior
         // tslint:disable:forin
         for (const p in newObject) {
+            if (isPrototypePolluted(p)) continue
             originalObject[p] = processBehavior(originalObject[p], newObject[p], behavior);
         }
         // tslint:enable:forin
         return originalObject;
     }
 };
 
+const isPrototypePolluted = (key: any) => {
+    return ['__proto__', 'constructor', 'prototype'].includes(key)
+}
+
 /**
  * Recursively merge two objects together.
  * @param originalObject The base object. Properties here will be overwritten
@@ -72,7 +77,7 @@ export const Merge = (originalObject: any, newObject: any, behavior?: IMergeBeha
             return definedBehaviorResults;
         }
     }
-
+    
     return handleDefaultBehavior(originalObject, newObject, behavior);
 };