Merge pull request #144 from Jason3S/jdent-object-properties

fix: exception when glob pattern contains `constructor`

Author: jonschlinkert

lib/constants.js

@@ -99,6 +99,7 @@ module.exports = {
 
   // Replace globs with equivalent patterns to reduce parsing time.
   REPLACEMENTS: {
+    __proto__: null,
     '***': '*',
     '**/**': '**',
     '**/**/**': '**'

test/malicious.js

@@ -30,4 +30,9 @@ describe('handling of potential regex exploits', () => {
       assert(!isMatch('A', `!(${repeat(500)}A)`, { maxLength: 499 }));
     }, /Input length: 504, exceeds maximum allowed length: 499/);
   });
+  it('should be able to accept Object instance properties', () => {
+    assert(isMatch('constructor', 'constructor'), 'valid match');
+    assert(isMatch('__proto__', '__proto__'), 'valid match');
+    assert(isMatch('toString', 'toString'), 'valid match');
+  });
 });