Fix prototype pollution on unflatten

Fixes #105.
hughsk · Aug 6, 2020 · 5a7c5b8 · 5a7c5b8
1 parent 6ed45bb
commit 5a7c5b8
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/index.js b/index.js
@@ -77,6 +77,9 @@ function unflatten (target, opts) {
     var recipient = result
 
     while (key2 !== undefined) {
+      if (key1 === '__proto__') {
+        return
+      }
       var type = Object.prototype.toString.call(recipient[key1])
       var isobject = (
         type === '[object Object]' ||