From 948baf98634a5c206875b67d11368f133034fa90 Mon Sep 17 00:00:00 2001
From: Eran Hammer <eran@hammer.io>
Date: Fri, 7 Feb 2020 22:29:21 -0800
Subject: [PATCH] Prevent prototype poisoning in clone(). Closes #352

---
 lib/clone.js  | 4 ++++
 test/clone.js | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/clone.js b/lib/clone.js
index 73580d2a..e64defb8 100755
--- a/lib/clone.js
+++ b/lib/clone.js
@@ -77,6 +77,10 @@ module.exports = internals.clone = function (obj, options = {}, _seen = null) {
 
     const keys = Utils.keys(obj, options);
     for (const key of keys) {
+        if (key === '__proto__') {
+            continue;
+        }
+
         if (baseProto === Types.array &&
             key === 'length') {
 
diff --git a/test/clone.js b/test/clone.js
index a0bb28ab..20754e97 100755
--- a/test/clone.js
+++ b/test/clone.js
@@ -818,7 +818,7 @@ describe('clone()', () => {
 
     it('prevents prototype poisoning', () => {
 
-        const a = JSON.parse('{ "proto": { "x": 1 } }');
+        const a = JSON.parse('{ "__proto__": { "x": 1 } }');
         expect(a.x).to.not.exist();
 
         const b = Hoek.clone(a);