@adobe/alloy 2.30.1-beta.15 → 2.30.1-beta.16

package/libEs5/constants/libraryVersion.js

@@ -14,4 +14,4 @@ governing permissions and limitations under the License.
 */
 // The __VERSION__ keyword will be replace at alloy build time with the package.json version.
 // see babel-plugin-version
-var _default = exports.default = "2.30.1-beta.15";
+var _default = exports.default = "2.30.1-beta.16";

package/libEs5/utils/deepAssign.js

@@ -15,8 +15,13 @@ OF ANY KIND, either express or implied. See the License for the specific languag
 governing permissions and limitations under the License.
 */
 
+// Keys that should never be copied to prevent prototype pollution.
+const DANGEROUS_KEYS = ["__proto__", "constructor", "prototype"];
 const deepAssignObject = (target, source) => {
   Object.keys(source).forEach(key => {
+    if (DANGEROUS_KEYS.includes(key)) {
+      return;
+    }
     if ((0, _isObject.default)(target[key]) && (0, _isObject.default)(source[key])) {
       deepAssignObject(target[key], source[key]);
       return;

package/libEs6/constants/libraryVersion.js

@@ -13,4 +13,4 @@ governing permissions and limitations under the License.
 // The __VERSION__ keyword will be replace at alloy build time with the package.json version.
 // see babel-plugin-version
 
-export default "2.30.1-beta.15";
+export default "2.30.1-beta.16";

package/libEs6/utils/deepAssign.js

@@ -12,8 +12,14 @@ governing permissions and limitations under the License.
 
 import isNil from "./isNil.js";
 import isObject from "./isObject.js";
+
+// Keys that should never be copied to prevent prototype pollution.
+const DANGEROUS_KEYS = ["__proto__", "constructor", "prototype"];
 const deepAssignObject = (target, source) => {
   Object.keys(source).forEach(key => {
+    if (DANGEROUS_KEYS.includes(key)) {
+      return;
+    }
     if (isObject(target[key]) && isObject(source[key])) {
       deepAssignObject(target[key], source[key]);
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/alloy",
-  "version": "2.30.1-beta.15",
+  "version": "2.30.1-beta.16",
   "description": "Adobe Experience Platform Web SDK",
   "type": "module",
   "main": "libEs5/index.js",

package/types/utils/deepAssign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepAssign.d.ts","sourceRoot":"","sources":["../../packages/core/src/utils/deepAssign.js"],"names":[],"mappings":"AAkCe,+DAUd"}
+{"version":3,"file":"deepAssign.d.ts","sourceRoot":"","sources":["../../packages/core/src/utils/deepAssign.js"],"names":[],"mappings":"AAwCe,+DAUd"}