fix(safeSet): prototype pollution #25

liriliri · Sep 22, 2021 · daeebe2 · daeebe2
1 parent e923f01
commit daeebe2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/src/safeSet.js b/src/safeSet.js
@@ -28,7 +28,7 @@
  * ): void;
  */
 
-_('castPath isUndef');
+_('castPath isUndef toStr isSymbol isStr');
 
 exports = function(obj, path, val) {
     path = castPath(path, obj);
@@ -38,6 +38,10 @@ exports = function(obj, path, val) {
 
     prop = path.shift();
     while (!isUndef(prop)) {
+        // #25
+        if (!isStr(prop) && !isSymbol(prop)) {
+            prop = toStr(prop);
+        }
         if (
             prop === '__proto__' ||
             prop === 'constructor' ||

diff --git a/test/safeSet.js b/test/safeSet.js
@@ -17,4 +17,7 @@ it('prototype pollution', function() {
 
     safeSet({}, 'constructor.prototype.oops', 'It works!');
     expect(a.oops).to.not.equal('It works!');
+
+    safeSet({}, [['__proto__'], 'oops'], 'It works!');
+    expect(a.oops).to.not.equal('It works!');
 });