Merge pull request #33 from ready-research/ready-research-Prototype-Pollution

jonschlinkert · web-flow · commit b057b1b8cf98 · 2021-09-12T03:30:50.000-04:00
Security Fix for Prototype Pollution
diff --git a/index.js b/index.js
@@ -18,6 +18,9 @@ const isUnsafeKey = key => {
 };
 
 const validateKey = key => {
+  if (typeof key !== 'string' && typeof key !== 'number') {
+    key = String(key)
+  }
   if (isUnsafeKey(key)) {
     throw new Error(`Cannot set unsafe key: "${key}"`);
   }

Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,9 @@ const isUnsafeKey = key => {`
`18`	`18`	`};`
`19`	`19`
`20`	`20`	`const validateKey = key => {`
	`21`	`+ if (typeof key !== 'string' && typeof key !== 'number') {`
	`22`	`+ key = String(key)`
	`23`	`+ }`
`21`	`24`	`if (isUnsafeKey(key)) {`
`22`	`25`	throw new Error(`Cannot set unsafe key: "${key}"`);
`23`	`26`	`}`