fix: CVE-2021-25943

package.json

@@ -1,6 +1,6 @@
 {
   "name": "101",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "common javascript utils that can be required selectively that assume es5+",
   "main": "index.js",
   "scripts": {

set.js

@@ -19,6 +19,9 @@ var keypather = require('keypather')();
 module.exports = set;
 
 function set (obj, key, val) {
+  if (key === '__proto__' || key === 'prototype' || key === 'constructor') {
+    throw new Error('Invalid key arguments: __proto__, prototype and constructor cannot be set');
+  }
   var setObj;
   if (arguments.length === 1) {
     // (setObj)

test/test-set.js

@@ -165,6 +165,33 @@ describe('set', function () {
         expect(err).to.exist();
         done();
       }
+    }); 
+    it('should error when when using __proto__ reserved key', function (done) {
+      try {
+        set(() => {}, "__proto__");
+      }
+      catch (err) {
+        expect(err).to.exist();  
+        done(); 
+      }
+    });
+    it('should error when when using prototype reserved key', function (done) {
+      try {
+        set(() => {}, "prototype");
+      }
+      catch (err) {
+        expect(err).to.exist();  
+        done();  
+      }
+    });
+    it('should error when when using constructor reserved key', function (done) {
+      try {
+        set(() => {}, "constructor");
+      }
+      catch (err) {
+        expect(err).to.exist(); 
+        done();
+      }
     });
   });
 });