Update processNested.js

richardgirges · Aug 5, 2020 · 8bf7427 · 8bf7427
1 parent fd40389
commit 8bf7427
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/lib/processNested.js b/lib/processNested.js
@@ -1,4 +1,6 @@
-const INVALID_KEYS = ['__proto__', 'constructor'];
+const OBJECT_PROTOTYPE_KEYS = Object.getOwnPropertyNames(Object.prototype);
+const ARRAY_PROTOTYPE_KEYS = Object.getOwnPropertyNames(Array.prototype);
+
 
 module.exports = function(data){
   if (!data || data.length < 1) return {};
@@ -19,7 +21,7 @@ module.exports = function(data){
       let k = keyParts[index];
 
       // Ensure we don't allow prototype pollution
-      if (INVALID_KEYS.includes(k)) {
+      if (OBJECT_PROTOTYPE_KEYS.includes(k) || (ARRAY_PROTOTYPE_KEYS.includes(k) && Array.isArray(current)) {
         continue;
       }
 
@@ -33,4 +35,4 @@ module.exports = function(data){
   }
 
   return d;
-};
+};