mongoose_proto.patch 400 B

123456789101112
  1. --- services/web/node_modules/mongoose/lib/document.js
  2. +++ services/web/node_modules/mongoose/lib/document.js
  3. @@ -739,6 +739,10 @@ function init(self, obj, doc, opts, prefix) {
  4. function _init(index) {
  5. i = keys[index];
  6. + // avoid prototype pollution
  7. + if (i === '__proto__' || i === 'constructor') {
  8. + return;
  9. + }
  10. path = prefix + i;
  11. schemaType = docSchema.path(path);