Prevent proto name. Closes #22

Author: hueniverse

lib/index.js

@@ -100,21 +100,31 @@ exports.disposition = function (header) {
             throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
         }
 
+        let value;
+
         if ($2) {
             if (!$3) {
                 throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
             }
 
             try {
-                result[$1] = decodeURIComponent($3.split('\'')[2]);
+                value = decodeURIComponent($3.split('\'')[2]);
             }
             catch (err) {
                 throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
             }
         }
         else {
-            result[$1] = $4 || $5 || '';
+            value = $4 || $5 || '';
+        }
+
+        if ($1 === 'name' &&
+            value === '__proto__') {
+
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
         }
+
+        result[$1] = value;
     });
 
     if (!result.name) {

test/index.js

@@ -169,4 +169,10 @@ describe('disposition()', () => {
         const header = 'form-data; name="file"; filename=file.jpg; __proto__=x';
         expect(() => Content.disposition(header)).to.throw('Invalid content-disposition header format includes invalid parameters');
     });
+
+    it('errors on __proto__ name param value', () => {
+
+        const header = 'form-data; name="__proto__"; filename=file.jpg';
+        expect(() => Content.disposition(header)).to.throw('Invalid content-disposition header format includes invalid parameters');
+    });
 });