fix: explicit "__proto__" guard;

- Closes #11
lukeed · Jan 13, 2020 · 200e8d1 · 200e8d1
1 parent 4e73d31
commit 200e8d1
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/src/index.js b/src/index.js
@@ -6,8 +6,17 @@ export default function klona(x) {
 	if (str === '[object Object]') {
 		tmp = {};
 		for (k in x) {
+			if (k === '__proto__') {
+				Object.defineProperty(tmp, k, {
+					value: klona(x[k]),
+					configurable: 1,
+					enumerable: 1,
+					writable: 1,
+				});
+			} else {
 			tmp[k] = klona(x[k]);
 		}
+		}
 		return tmp;
 	}
 

diff --git a/test/index.js b/test/index.js
@@ -99,16 +99,17 @@ test('constructor :: pollution', t => {
 	);
 
 	t.not(({})['a0'], true, 'Safe POJO');
+	t.not(new Object()['a0'], true, 'Safe Object');
 	t.not(input['a0'], true, 'Safe input');
 	t.not(output['a0'], true, 'Safe output');
 
 	t.end();
 });
 
 
+// @see https://snyk.io/vuln/SNYK-JS-LODASH-450202
 test('prototype :: pollution', t => {
 	const payload = '{"__proto__":{"a0":true}}';
-
 	const input = JSON.parse(payload);
 	const output = klona(input);
 
@@ -118,6 +119,7 @@ test('prototype :: pollution', t => {
 	);
 
 	t.not(({})['a0'], true, 'Safe POJO');
+	t.not(new Object()['a0'], true, 'Safe Object');
 	t.not(input['a0'], true, 'Safe input');
 	t.not(output['a0'], true, 'Safe output');