Fix Prototype Pollution vulnerability (CVE-2023-26102) by applying changes from timdown#482

Author: Sergei Tomin

README.md

@@ -1,3 +1,5 @@
+### This fork includes PR with a vulnerability fix (https://github.com/timdown/rangy/pull/482)
+
 Rangy
 =====
 

lib/rangy-core.js

@@ -158,6 +158,9 @@
         util.extend = extend = function(obj, props, deep) {
             var o, p;
             for (var i in props) {
+                if (i === "__proto__" || i === "constructor" || i === "prototype") {
+                    continue;
+                }
                 if (props.hasOwnProperty(i)) {
                     o = obj[i];
                     p = props[i];
@@ -3862,7 +3865,7 @@
             win = null;
         });
     });
-    
+
 
     /*----------------------------------------------------------------------------------------------------------------*/
 
@@ -3893,4 +3896,4 @@
     }
 
     return api;
-}, this);
+}, this);

package.json

@@ -1,7 +1,7 @@
 {
     "name": "rangy",
     "description": "A cross-browser DOM range and selection library",
-    "version": "1.3.1",
+    "version": "1.3.2",
     "author": {
         "name": "Tim Down",
         "email": "tim@timdown.co.uk",
@@ -33,4 +33,4 @@
         "jshint": "^2.13.5",
         "archiver": "^5.3.1"
     }
-}
+}

src/core/core.js

@@ -159,6 +159,9 @@
         util.extend = extend = function(obj, props, deep) {
             var o, p;
             for (var i in props) {
+                if (i === "__proto__" || i === "constructor" || i === "prototype") {
+                    continue;
+                }
                 if (props.hasOwnProperty(i)) {
                     o = obj[i];
                     p = props[i];
@@ -511,4 +514,4 @@
     }
 
     return api;
-}, this);
+}, this);