From 20ef0ef55dfa028caddaedbcb33efbdb04d18e13 Mon Sep 17 00:00:00 2001 From: Matthias Kunnen Date: Tue, 21 Jul 2020 03:29:04 +0000 Subject: [PATCH] Fix prototype pollution on unflatten Fixes #105. --- index.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/index.js b/index.js index c8032e9..7193884 100644 --- a/index.js +++ b/index.js @@ -116,6 +116,10 @@ function unflatten (target, opts) { let recipient = result while (key2 !== undefined) { + if (key1 === '__proto__') { + return + } + const type = Object.prototype.toString.call(recipient[key1]) const isobject = ( type === '[object Object]' ||