fix: fix for Prototype Pollution (#304)

styled-components · Sep 3, 2021 · 34ed147 · 34ed147
1 parent b69619e
commit 34ed147
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/packages/util/src/index.ts b/packages/util/src/index.ts
@@ -4,6 +4,7 @@ export * from './types'
 
 const DEV = process.env.NODE_ENV !== 'production'
 
+const specialProperties = ['__proto__', 'constructor', 'prototype'];
 /**
  * Identity function.
  */
@@ -66,6 +67,9 @@ export const get = (from: unknown, path: Path): unknown => {
 export const assign = <T, U>(target: T, source: U): T & U => {
   if (!is(source)) return target as T & U
   for (const key in source) {
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     // @ts-ignore
     target[key] = source[key]
   }
@@ -78,6 +82,9 @@ export const assign = <T, U>(target: T, source: U): T & U => {
 export const merge = <T, U>(target: T, source: U): T & U => {
   if (!is(source)) return target as T & U
   for (const key in source) {
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     // @ts-ignore
     if (obj(target[key])) {
       // @ts-ignore