diff --git a/test/test.js b/test/test.js index 5c1930fa6..35aed9c27 100644 --- a/test/test.js +++ b/test/test.js @@ -7555,16 +7555,34 @@ } }); - QUnit.test('should not merge `Object.prototype` properties', function(assert) { - assert.expect(1); + QUnit.test('should not indirectly merge builtin prototype properties', function(assert) { + assert.expect(2); + + _.merge({}, { 'toString': { 'constructor': { 'prototype': { 'a': 1 } } } }); + + var actual = 'a' in funcProto; + delete funcProto.a; + + assert.notOk(actual); _.merge({}, { 'constructor': { 'prototype': { 'a': 1 } } }); - var actual = 'a' in objectProto; + actual = 'a' in objectProto; delete objectProto.a; assert.notOk(actual); }); + + QUnit.test('should not indirectly merge `Object` properties', function(assert) { + assert.expect(1); + + _.merge({}, { 'constructor': { 'a': 1 } }); + + var actual = 'a' in Object; + delete Object.a; + + assert.notOk(actual); + }); }()); /*--------------------------------------------------------------------------*/