test: test fixture for snyk protect

packages/snyk-protect/test/fixtures/multiple-matching-paths/.snyk

@@ -0,0 +1,25 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.19.0
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  SNYK-JS-LODASH-567746:
+    - tap > nyc > istanbul-lib-instrument > babel-types > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-generator > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-traverse > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-template > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-generator > babel-types > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-traverse > babel-types > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-template > babel-types > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-template > babel-traverse > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+    - tap > nyc > istanbul-lib-instrument > babel-template > babel-traverse > babel-types > lodash:
+        patched: '2021-02-17T13:43:51.857Z'
+

packages/snyk-protect/test/fixtures/multiple-matching-paths/README.md

@@ -0,0 +1,4 @@
+Location of lodash package.json:
+```
+node_modules/nyc/node_modules/lodash
+```

packages/snyk-protect/test/fixtures/multiple-matching-paths/expected_patchfile.patch

@@ -0,0 +1,66 @@
+# Licence
+# ---------
+# The MIT License
+
+# Copyright JS Foundation and other contributors <https://js.foundation/>
+
+# Based on Underscore.js, copyright Jeremy Ashkenas,
+# DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
+
+# This software consists of voluntary contributions made by many
+# individuals. For exact contribution history, see the revision history
+# available at https://github.com/lodash/lodash
+
+# The following license applies to all parts of this software except as
+# documented below:
+
+# ====
+
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+# ====
+
+# Copyright and related rights for sample code are waived via CC0. Sample
+# code is defined as all source code displayed within the prose of the
+# documentation.
+
+# CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+# ====
+
+# Files located in the node_modules and vendor directories are externally
+# maintained libraries used by this software which have their own
+# licenses; we recommend you read them, as their terms may differ from the
+# terms above.
+diff --git a/lodash.js b/lodash.js
+index 9b95dfef..43e71ffb 100644
+--- a/lodash.js
++++ b/lodash.js
+@@ -3977,6 +3977,10 @@
+         var key = toKey(path[index]),
+             newValue = value;
+
++        if ((key === '__proto__' || key === 'constructor' || key === 'prototype')) {
++          return object;
++        }
++
+         if (index != lastIndex) {
+           var objValue = nested[key];
+           newValue = customizer ? customizer(objValue, key, nested) : undefined;