Merge pull request #482 from JordiVM/master

Fix Prototype Pollution vulnerability (CVE-2023-26102) [security]

Author: timdown

lib/rangy-core.js

@@ -158,6 +158,9 @@
         util.extend = extend = function(obj, props, deep) {
             var o, p;
             for (var i in props) {
+                if (i === "__proto__" || i === "constructor" || i === "prototype") {
+                    continue;
+                }
                 if (props.hasOwnProperty(i)) {
                     o = obj[i];
                     p = props[i];
@@ -3893,4 +3896,4 @@
     }
 
     return api;
-}, this);
+}, this);