fix(security): prevent prototype pollution in memory store (#397)

Author: mhamann

lib/nconf/stores/memory.js

@@ -92,7 +92,7 @@ Memory.prototype.set = function (key, value) {
   //
   while (path.length > 1) {
     key = path.shift();
-    if (!target[key] || typeof target[key] !== 'object') {
+    if (!target[key] || typeof target[key] !== 'object' || !Object.hasOwnProperty.call(target, key)) {
       target[key] = {};
     }
 

test/stores/memory-store-test.js

@@ -121,5 +121,12 @@ vows.describe('nconf/stores/memory').addBatch({
         assert.equal(store.get('foo').bar.bazz, 'buzz');
       }
     }
+  },
+  "When attempting prototype pollution": {
+    topic: new nconf.Memory(),
+    "should not be able to pollute the prototype": function (store) {
+      store.set('__proto__:polluted', 'yes');
+      assert.equal({}.polluted, undefined);
+    }
   }
 }).export(module);