diff --git a/dist/index.js b/dist/index.js index 241a927..a2ba181 100644 --- a/dist/index.js +++ b/dist/index.js @@ -146,6 +146,9 @@ class PTree { set(key, value) { const segments = getSegments(key); let obj = this.root; + if(segments.includes('__proto__') || segments.includes('constructor') || segments.includes('prototype')){ + return undefined; + } for (let i = 0; i < segments.length; i++) { const current = obj; const seg = segments[i]; diff --git a/src/index.ts b/src/index.ts index d3971c8..4d3c099 100644 --- a/src/index.ts +++ b/src/index.ts @@ -176,6 +176,11 @@ export default class PTree { // Iterative deep object descent & set let obj = this.root; + + // Prototype pollution mitigation + if(segments.includes('__proto__') || segments.includes('constructor') || segments.includes('prototype')){ + return undefined; + } for (let i = 0; i < segments.length; i++) { const current = obj;