File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -104,5 +104,26 @@ test('core modules', function (t) {
104104 st . end ( ) ;
105105 } ) ;
106106
107+ t . test ( 'Object.prototype pollution' , function ( st ) {
108+ var nonKey = 'not a core module' ;
109+ st . teardown ( function ( ) {
110+ delete Object . prototype . fs ;
111+ delete Object . prototype . path ;
112+ delete Object . prototype . http ;
113+ delete Object . prototype [ nonKey ] ;
114+ } ) ;
115+ Object . prototype . fs = false ;
116+ Object . prototype . path = '>= 999999999' ;
117+ Object . prototype . http = data . http ;
118+ Object . prototype [ nonKey ] = true ;
119+
120+ st . equal ( isCore ( 'fs' ) , true , 'fs is a core module even if Object.prototype lies' ) ;
121+ st . equal ( isCore ( 'path' ) , true , 'path is a core module even if Object.prototype lies' ) ;
122+ st . equal ( isCore ( 'http' ) , true , 'path is a core module even if Object.prototype matches data' ) ;
123+ st . equal ( isCore ( nonKey ) , false , '"' + nonKey + '" is not a core module even if Object.prototype lies' ) ;
124+
125+ st . end ( ) ;
126+ } ) ;
127+
107128 t . end ( ) ;
108129} ) ;
You can’t perform that action at this time.
0 commit comments