Merge branch 'luci-m-666-master'

flitbit · Oct 21, 2020 · 96cf9ce · 96cf9ce
2 parents 983a133 + 2be9b5f
commit 96cf9ce
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/util.ts b/src/util.ts
@@ -172,6 +172,9 @@ export function setValueAtPath(target: unknown, val: unknown, path: PathSegments
   let p: number;
   while (++cursor < len) {
     step = path[cursor];
+    if (step === '__proto__' || step === 'constructor' || step === 'prototype') {
+      throw new Error('Prototype pollution attempt detected.');
+    }
     if (Array.isArray(it)) {
       if (step === '-' && cursor === end) {
         it.push(val);