chore(config): guard against prototype pollution

NicTool · Feb 28, 2024 · 3a17432 · 3a17432
1 parent 93cb6eb
commit 3a17432
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/config.js b/lib/config.js
@@ -48,6 +48,7 @@ class Config {
 
 function applyDefaults(cfg = {}, defaults = {}) {
   for (const d in defaults) {
+    if (d === "__proto__" || d === "constructor") continue;
     if ([undefined, null].includes(cfg[d])) {
       cfg[d] = defaults[d]
     } else if (typeof cfg[d] === 'object' && typeof defaults[d] === 'object') {