Skip to content

Commit

Permalink
Use Object.create(null) as merge target (#7920)
Browse files Browse the repository at this point in the history
  • Loading branch information
kurkle authored Oct 18, 2020
1 parent dff7140 commit 1d92605
Show file tree
Hide file tree
Showing 4 changed files with 11 additions and 6 deletions.
8 changes: 4 additions & 4 deletions src/core/core.controller.js
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ defaults._set('global', {
* returns a deep copy of the result, thus doesn't alter inputs.
*/
function mergeScaleConfig(/* config objects ... */) {
return helpers.merge({}, [].slice.call(arguments), {
return helpers.merge(Object.create(null), [].slice.call(arguments), {
merger: function(key, target, source, options) {
if (key === 'xAxes' || key === 'yAxes') {
var slen = source[key].length;
Expand Down Expand Up @@ -81,9 +81,9 @@ function mergeScaleConfig(/* config objects ... */) {
* a deep copy of the result, thus doesn't alter inputs.
*/
function mergeConfig(/* config objects ... */) {
return helpers.merge({}, [].slice.call(arguments), {
return helpers.merge(Object.create(null), [].slice.call(arguments), {
merger: function(key, target, source, options) {
var tval = target[key] || {};
var tval = target[key] || Object.create(null);
var sval = source[key];

if (key === 'scales') {
Expand All @@ -100,7 +100,7 @@ function mergeConfig(/* config objects ... */) {
}

function initConfig(config) {
config = config || {};
config = config || Object.create(null);

// Do NOT use mergeConfig for the data object because this method merges arrays
// and so would change references to labels and datasets, preventing data updates.
Expand Down
2 changes: 1 addition & 1 deletion src/core/core.datasetController.js
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,7 @@ helpers.extend(DatasetController.prototype, {
*/
_configure: function() {
var me = this;
me._config = helpers.merge({}, [
me._config = helpers.merge(Object.create(null), [
me.chart.options.datasets[me._type],
me.getDataset(),
], {
Expand Down
2 changes: 1 addition & 1 deletion src/core/core.scaleService.js
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ module.exports = {
},
getScaleDefaults: function(type) {
// Return the scale defaults merged with the global settings so that we always use the latest ones
return this.defaults.hasOwnProperty(type) ? helpers.merge({}, [defaults.scale, this.defaults[type]]) : {};
return this.defaults.hasOwnProperty(type) ? helpers.merge(Object.create(null), [defaults.scale, this.defaults[type]]) : {};
},
updateScaleDefaults: function(type, additions) {
var me = this;
Expand Down
5 changes: 5 additions & 0 deletions test/specs/helpers.core.tests.js
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,11 @@ describe('Chart.helpers.core', function() {
});

describe('clone', function() {
it('should not allow prototype pollution', function() {
var test = helpers.clone(JSON.parse('{"__proto__":{"polluted": true}}'));
expect(test.prototype).toBeUndefined();
expect(Object.prototype.polluted).toBeUndefined();
});
it('should clone primitive values', function() {
expect(helpers.clone()).toBe(undefined);
expect(helpers.clone(null)).toBe(null);
Expand Down

0 comments on commit 1d92605

Please sign in to comment.