From c2f845442202446f4747d1f0e2cd152e999505cf Mon Sep 17 00:00:00 2001
From: Alejandro Romero <alromh87@gmail.com>
Date: Fri, 9 Oct 2020 12:00:03 +0000
Subject: [PATCH] Fix Prototype Pollution

---
 dist/merge.browser.min.js  | 2 +-
 dist/merge.browser.test.js | 2 +-
 lib/src/index.js           | 2 +-
 src/index.ts               | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dist/merge.browser.min.js b/dist/merge.browser.min.js
index 35e136f..db6ad06 100644
--- a/dist/merge.browser.min.js
+++ b/dist/merge.browser.min.js
@@ -1 +1 @@
-var merge=function(r){var e={};function t(n){if(e[n])return e[n].exports;var o=e[n]={i:n,l:!1,exports:{}};return r[n].call(o.exports,o,o.exports,t),o.l=!0,o.exports}return t.m=r,t.c=e,t.d=function(r,e,n){t.o(r,e)||Object.defineProperty(r,e,{enumerable:!0,get:n})},t.r=function(r){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(r,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(r,"__esModule",{value:!0})},t.t=function(r,e){if(1&e&&(r=t(r)),8&e)return r;if(4&e&&"object"==typeof r&&r&&r.__esModule)return r;var n=Object.create(null);if(t.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:r}),2&e&&"string"!=typeof r)for(var o in r)t.d(n,o,function(e){return r[e]}.bind(null,o));return n},t.n=function(r){var e=r&&r.__esModule?function(){return r.default}:function(){return r};return t.d(e,"a",e),e},t.o=function(r,e){return Object.prototype.hasOwnProperty.call(r,e)},t.p="",t(t.s=0)}([function(r,e,t){"use strict";function n(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return o.apply(void 0,r)}function o(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return c(!0===r[0],!1,r)}function u(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return c(!0===r[0],!0,r)}function i(r){if(Array.isArray(r)){for(var e=[],t=0;t<r.length;++t)e.push(i(r[t]));return e}if(f(r)){e={};for(var t in r)e[t]=i(r[t]);return e}return r}function f(r){return r&&"object"==typeof r&&!Array.isArray(r)}function a(r,e){if(!f(r))return e;for(var t in e)r[t]=f(r[t])&&f(e[t])?a(r[t],e[t]):e[t];return r}function c(r,e,t){var n;!r&&f(n=t.shift())||(n={});for(var o=0;o<t.length;++o){var u=t[o];if(f(u))for(var c in u)if("__proto__"!==c){var l=r?i(u[c]):u[c];n[c]=e?a(n[c],l):l}}return n}Object.defineProperty(e,"__esModule",{value:!0}),r.exports=e=n,e.default=n,e.main=n,n.clone=i,n.isPlainObject=f,n.recursive=u,e.merge=o,e.recursive=u,e.clone=i,e.isPlainObject=f}]).default;
\ No newline at end of file
+var merge=function(r){var e={};function t(n){if(e[n])return e[n].exports;var o=e[n]={i:n,l:!1,exports:{}};return r[n].call(o.exports,o,o.exports,t),o.l=!0,o.exports}return t.m=r,t.c=e,t.d=function(r,e,n){t.o(r,e)||Object.defineProperty(r,e,{enumerable:!0,get:n})},t.r=function(r){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(r,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(r,"__esModule",{value:!0})},t.t=function(r,e){if(1&e&&(r=t(r)),8&e)return r;if(4&e&&"object"==typeof r&&r&&r.__esModule)return r;var n=Object.create(null);if(t.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:r}),2&e&&"string"!=typeof r)for(var o in r)t.d(n,o,function(e){return r[e]}.bind(null,o));return n},t.n=function(r){var e=r&&r.__esModule?function(){return r.default}:function(){return r};return t.d(e,"a",e),e},t.o=function(r,e){return Object.prototype.hasOwnProperty.call(r,e)},t.p="",t(t.s=0)}([function(r,e,t){"use strict";function n(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return o.apply(void 0,r)}function o(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return c(!0===r[0],!1,r)}function u(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return c(!0===r[0],!0,r)}function i(r){if(Array.isArray(r)){for(var e=[],t=0;t<r.length;++t)e.push(i(r[t]));return e}if(f(r)){e={};for(var t in r)e[t]=i(r[t]);return e}return r}function f(r){return r&&"object"==typeof r&&!Array.isArray(r)}function a(r,e){if(!f(r))return e;for(var t in e)r[t]=f(r[t])&&f(e[t])?a(r[t],e[t]):e[t];return r}function c(r,e,t){var n;!r&&f(n=t.shift())||(n={});for(var o=0;o<t.length;++o){var u=t[o];if(f(u))for(var c in u)if("__proto__"!==c&&"constructor"!==c&&"prototype"!==c){var l=r?i(u[c]):u[c];n[c]=e?a(n[c],l):l}}return n}Object.defineProperty(e,"__esModule",{value:!0}),r.exports=e=n,e.default=n,e.main=n,n.clone=i,n.isPlainObject=f,n.recursive=u,e.merge=o,e.recursive=u,e.clone=i,e.isPlainObject=f}]).default;
\ No newline at end of file
diff --git a/dist/merge.browser.test.js b/dist/merge.browser.test.js
index 163e380..043e06d 100644
--- a/dist/merge.browser.test.js
+++ b/dist/merge.browser.test.js
@@ -276,7 +276,7 @@ function _merge(isClone, isRecursive, items) {
         if (!isPlainObject(item))
             continue;
         for (var key in item) {
-            if (key === '__proto__')
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype')
                 continue;
             var value = isClone ? clone(item[key]) : item[key];
             result[key] = isRecursive ? _recursiveMerge(result[key], value) : value;
diff --git a/lib/src/index.js b/lib/src/index.js
index a183e5d..33cd9a3 100644
--- a/lib/src/index.js
+++ b/lib/src/index.js
@@ -69,7 +69,7 @@ function _merge(isClone, isRecursive, items) {
         if (!isPlainObject(item))
             continue;
         for (var key in item) {
-            if (key === '__proto__')
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype')
                 continue;
             var value = isClone ? clone(item[key]) : item[key];
             result[key] = isRecursive ? _recursiveMerge(result[key], value) : value;
diff --git a/src/index.ts b/src/index.ts
index 1ab7cbe..9b84bac 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -85,7 +85,7 @@ function _merge(isClone: boolean, isRecursive: boolean, items: any[]) {
 			continue
 
 		for (const key in item) {
-			if (key === '__proto__') continue
+			if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue
 			const value = isClone ? clone(item[key]) : item[key]
 			result[key] = isRecursive ? _recursiveMerge(result[key], value) : value
 		}