fix: deny modifying the object prototype

sequelize · Oct 25, 2023 · ff1d9d8 · ff1d9d8
1 parent 837a3cc
commit ff1d9d8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/shared/object.ts b/src/shared/object.ts
@@ -14,7 +14,7 @@ export function deepAssign<T, S>(target: T, source: S): T & S;
 export function deepAssign<S>(target: {}, source: S): S;
 export function deepAssign(target: any, ...sources: any[]): any {
   sources.forEach((source) => {
-    Object.getOwnPropertyNames(source).forEach((key) => assign(key, target, source));
+    Object.getOwnPropertyNames(source).forEach((key) => !["__proto__", "constructor", "prototype"].includes(key) && assign(key, target, source));
     /* istanbul ignore next */
     if (Object.getOwnPropertySymbols) {
       Object.getOwnPropertySymbols(source).forEach((key) => assign(key, target, source));