CVE 2021 25943 fix2

package.json

@@ -1,6 +1,6 @@
 {
   "name": "101",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "common javascript utils that can be required selectively that assume es5+",
   "main": "index.js",
   "scripts": {

set.js

@@ -19,6 +19,9 @@ var keypather = require('keypather')();
 module.exports = set;
 
 function set (obj, key, val) {
+  if (key === '__proto__' || key === 'prototype' || key === 'constructor') {
+    return
+  }
   var setObj;
   if (arguments.length === 1) {
     // (setObj)

test/test-put.js

@@ -121,7 +121,6 @@ describe('put', function () {
 
   describe('keypaths', function () {
     it('should put via keypath object', function (done) {
-      console.log('hello')
       var obj = {
         foo: {
           bar: 1

test/test-set.js

@@ -165,6 +165,27 @@ describe('set', function () {
         expect(err).to.exist();
         done();
       }
+    }); 
+    it('should do nothing when when using __proto__ reserved key', function (done) {
+        target = {}
+        saved = target.__proto__
+        set(target, "__proto__", null);
+        expect(target.__proto__).to.equal(saved);
+        done();
+    });
+    it('should do nothing when using prototype reserved key', function (done) {
+      target = {}
+      saved = target.prototype
+      set(target, "prototype", null);
+      expect(target.prototype).to.equal(saved);
+      done()
+    });
+    it('should do nothing when using constructor reserved key', function (done) {
+      target = {}
+      saved = target.constructor
+      set(target, "constructor", null);
+      expect(target.constructor).to.equal(saved);
+      done()
     });
   });
 });