fix(zipObjectDeep): prototype pollution (#4759)

2026-01-29 06:27:49 +00:00 · 2020-07-02 23:47:49 +02:00
parent e7b28ea6cb
commit c84fe82760
2 changed files with 37 additions and 0 deletions
--- a/lodash.js
+++ b/lodash.js
@@ -3990,6 +3990,10 @@
        var key = toKey(path[index]),
            newValue = value;

+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          return object;
+        }
+
        if (index != lastIndex) {
          var objValue = nested[key];
          newValue = customizer ? customizer(objValue, key, nested) : undefined;