diff --git a/package.json b/package.json index dfccd64..cddae5d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "101", - "version": "1.6.3", + "version": "1.6.4", "description": "common javascript utils that can be required selectively that assume es5+", "main": "index.js", "scripts": { diff --git a/set.js b/set.js index 61797ba..b023afa 100644 --- a/set.js +++ b/set.js @@ -19,6 +19,9 @@ var keypather = require('keypather')(); module.exports = set; function set (obj, key, val) { + if (key === '__proto__' || key === 'prototype' || key === 'constructor') { + throw new Error('Invalid key arguments: __proto__, prototype and constructor cannot be set'); + } var setObj; if (arguments.length === 1) { // (setObj) diff --git a/test/test-set.js b/test/test-set.js index a4462fb..514dd6e 100644 --- a/test/test-set.js +++ b/test/test-set.js @@ -165,6 +165,33 @@ describe('set', function () { expect(err).to.exist(); done(); } + }); + it('should error when when using __proto__ reserved key', function (done) { + try { + set(() => {}, "__proto__"); + } + catch (err) { + expect(err).to.exist(); + done(); + } + }); + it('should error when when using prototype reserved key', function (done) { + try { + set(() => {}, "prototype"); + } + catch (err) { + expect(err).to.exist(); + done(); + } + }); + it('should error when when using constructor reserved key', function (done) { + try { + set(() => {}, "constructor"); + } + catch (err) { + expect(err).to.exist(); + done(); + } }); }); });