From 383b72d47c74a55ae8b6e231da548f9280a4296a Mon Sep 17 00:00:00 2001 From: ready-research <72916209+ready-research@users.noreply.github.com> Date: Mon, 30 Aug 2021 15:17:34 +0530 Subject: [PATCH] Security Fix for Prototype Pollution Fix prototype pollution when path components are not strings --- index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/index.js b/index.js index d3335b7..6d0c712 100644 --- a/index.js +++ b/index.js @@ -18,6 +18,9 @@ const isUnsafeKey = key => { }; const validateKey = key => { + if (typeof key !== 'string' && typeof key !== 'number') { + key = String(key) + } if (isUnsafeKey(key)) { throw new Error(`Cannot set unsafe key: "${key}"`); }