filter out invalid keys

- since this is just a patch bump, the invalid keys are only being filtered out to fix the bug
- in a future version, throw an error on invalid keys

index.js

@@ -9,6 +9,10 @@
 
 var toPath = require('to-object-path');
 
+function isValidKey(key) {
+  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
+}
+
 /**
  * Defines a getter function on an object using property path notation.
  *
@@ -40,11 +44,13 @@ function setGetter(obj, prop, getter) {
 
 function define(obj, prop, getter) {
   if (!~prop.indexOf('.')) {
-    defineProperty(obj, prop, getter);
+    if (isValidKey(prop)) {
+      defineProperty(obj, prop, getter);
+    }
     return obj;
   }
 
-  var keys = prop.split('.');
+  var keys = prop.split('.').filter(isValidKey);
   var last = keys.pop();
   var target = obj;
   var key;

test.js

@@ -106,10 +106,10 @@ describe('set-getter', function() {
     });
 
     assert(!('polluted' in {}));
-    assert(!('polluted' in obj));
+    assert('polluted' in obj);
 
     assert({}.polluted !== true);
-    assert(obj.polluted !== true);
+    assert(obj.polluted === true);
   });
 
   it('should not pollute the prototype when using array notation', function() {
@@ -123,9 +123,9 @@ describe('set-getter', function() {
     });
 
     assert(!('polluted' in {}));
-    assert(!('polluted' in obj));
+    assert('polluted' in obj);
 
     assert({}.polluted !== true);
-    assert(obj.polluted !== true);
+    assert(obj.polluted === true);
   });
 });