Explorar el Código

Security Update

[+] Protect Prototype
B0zal hace 1 año
padre
commit
22a6819f7b
Se han modificado 1 ficheros con 6 adiciones y 2 borrados
  1. 6 2
      app/utils/merge.ts

+ 6 - 2
app/utils/merge.ts

@@ -1,9 +1,13 @@
 export function merge(target: any, source: any) {
   Object.keys(source).forEach(function (key) {
-    if (source[key] && typeof source[key] === "object") {
+    if (
+      source.hasOwnProperty(key) && // Check if the property is not inherited
+      source[key] &&
+      typeof source[key] === "object" || key === "__proto__" || key === "constructor"
+    ) {
       merge((target[key] = target[key] || {}), source[key]);
       return;
     }
     target[key] = source[key];
   });
-}
+}