fix: prevent code injection in copying properties

adaltas · Sep 16, 2021 · db70fe9 · db70fe9
1 parent 0ae9132
commit db70fe9
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,10 @@
 
 # Changelog
 
+## Trunk
+
+* fix: prevent code injection in copying properties
+
 ## Version 0.5.1
 
 * fix: dont pollute object proto #1

diff --git a/dist/mixme.cjs.js b/dist/mixme.cjs.js
@@ -50,7 +50,10 @@ exports.mutate = function mutate() {
       }
 
       for (name in source) {
-        if (name === '__proto__') {
+        if (/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/.test(name)) {
+          // See
+          // https://github.com/adaltas/node-mixme/issues/1
+          // https://github.com/adaltas/node-mixme/issues/2
           continue;
         }
 

diff --git a/dist/mixme.esm.js b/dist/mixme.esm.js
@@ -46,7 +46,10 @@ _mutate = function mutate() {
       }
 
       for (name in source) {
-        if (name === '__proto__') {
+        if (/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/.test(name)) {
+          // See
+          // https://github.com/adaltas/node-mixme/issues/1
+          // https://github.com/adaltas/node-mixme/issues/2
           continue;
         }
 

diff --git a/dist/mixme.umd.js b/dist/mixme.umd.js
@@ -52,7 +52,10 @@
         }
 
         for (name in source) {
-          if (name === '__proto__') {
+          if (/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/.test(name)) {
+            // See
+            // https://github.com/adaltas/node-mixme/issues/1
+            // https://github.com/adaltas/node-mixme/issues/2
             continue;
           }
 

diff --git a/lib/index.js b/lib/index.js
diff --git a/src/index.coffee b/src/index.coffee
@@ -19,7 +19,10 @@ mutate = ->
     if is_object_literal source
       target = {} unless is_object_literal target
       for name of source
-        continue if name is '__proto__'
+        # See
+        # https://github.com/adaltas/node-mixme/issues/1
+        # https://github.com/adaltas/node-mixme/issues/2
+        continue if /__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/.test name
         target[name] = mutate target[name], source[name]
     else if Array.isArray source
       target = for v in source