fix(merge): prevent possible prototype pollution (#34)

lukeed · May 3, 2022 · 2d156c7 · 2d156c7
1 parent 56923fe
commit 2d156c7
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/merge.js b/src/merge.js
@@ -6,6 +6,7 @@ export function merge(a, b, k) {
 			}
 		} else {
 			for (k in b) {
+				if (k === '__proto__' || k === 'constructor' || k === 'prototype') break;
 				a[k] = merge(a[k], b[k]);
 			}
 		}