fix(utils): fix prototype attack for merge

koishijs · Apr 11, 2024 · 985ca8e · 985ca8e
1 parent e83e6bd
commit 985ca8e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/packages/utils/src/misc.ts b/packages/utils/src/misc.ts
@@ -17,9 +17,13 @@ export function defineEnumProperty<T extends object>(object: T, key: keyof T, va
 
 export function merge<T extends object>(head: T, base: T): T {
   Object.entries(base).forEach(([key, value]) => {
-    if (typeof head[key] === 'undefined') return head[key] = base[key]
+    if (typeof head[key] === 'undefined') return head[key] = value
+    // prevent prototype attack
+    if (!Object.hasOwn(head, key)) return
     if (typeof value === 'object' && typeof head[key] === 'object') {
       head[key] = merge(head[key], value)
+    } else {
+      head[key] = value
     }
   })
   return head