Backport #352. Closes #353

hapijs · Feb 8, 2020 · 4d0804b · 4d0804b
1 parent 4ae5f53
commit 4d0804b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/lib/clone.js b/lib/clone.js
@@ -75,6 +75,10 @@ module.exports = internals.clone = function (obj, options = {}, _seen = null) {
 
     const keys = Utils.keys(obj, options);
     for (const key of keys) {
+        if (key === '__proto__') {
+            continue;
+        }
+
         if (baseProto === Types.array &&
             key === 'length') {
 

diff --git a/test/index.js b/test/index.js
@@ -762,6 +762,15 @@ describe('clone()', () => {
         expect(copy.a).to.shallow.equal(obj.a);
         expect(copy.x).to.shallow.equal(obj);
     });
+
+    it('prevents prototype poisoning', () => {
+
+        const a = JSON.parse('{ "__proto__": { "x": 1 } }');
+        expect(a.x).to.not.exist();
+
+        const b = Hoek.clone(a);
+        expect(b.x).to.not.exist();
+    });
 });
 
 describe('merge()', () => {