Fix prototype pollution on unflatten

Fixes #105.
hughsk · Aug 6, 2020 · 20ef0ef · 20ef0ef
1 parent e8fb281
commit 20ef0ef
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/index.js b/index.js
@@ -116,6 +116,10 @@ function unflatten (target, opts) {
     let recipient = result
 
     while (key2 !== undefined) {
+      if (key1 === '__proto__') {
+        return
+      }
+
       const type = Object.prototype.toString.call(recipient[key1])
       const isobject = (
         type === '[object Object]' ||