fix: __proto__ copy

eggjs · Dec 31, 2021 · d9a525f · d9a525f
1 parent ddefb57
commit d9a525f
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 3 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -1,11 +1,13 @@
-sudo: false
+
 language: node_js
 node_js:
   - '4'
   - '6'
   - '7'
+before_install:
+  - npm i npminstall -g
 install:
-  - npm i npminstall && npminstall
+  - npminstall
 script:
   - npm run ci
 after_script:

diff --git a/appveyor.yml b/appveyor.yml
@@ -11,6 +11,6 @@ install:
 test_script:
   - node --version
   - npm --version
-  - npm run ci
+  - npm run test
 
 build: off
diff --git a/index.js b/index.js
@@ -47,6 +47,8 @@ module.exports = function extend() {
 
     // Extend the base object
     for (name in options) {
+      if (name === '__proto__') continue;
+
       src = target[name];
       copy = options[name];
 

diff --git a/test/index.js b/test/index.js
@@ -619,3 +619,13 @@ test('works without Array.isArray', function (t) {
   Array.isArray = savedIsArray;
   t.end();
 });
+
+test('fix __proto__ copy', function (t) {
+  var r = extend(true, {}, JSON.parse('{"__proto__": {"polluted": "yes"}}'));
+  t.deepEqual(
+    JSON.stringify(r),
+    '{}',
+    'It should not copy __proto__'
+  );
+  t.end();
+});