@almadar/evaluator 2.12.0 → 2.12.1

package/dist/index.js

@@ -1210,6 +1210,7 @@ function evalArrayDropLast(args, evaluate2, ctx) {
 }
 
 // std/object.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function evalLambda(lambdaExpr, evaluate2, ctx, ...values) {
   if (!isSExpr(lambdaExpr) || getOperator(lambdaExpr) !== "fn") {
     return evaluate2(lambdaExpr, ctx);
@@ -1272,6 +1273,9 @@ function evalObjectSet(args, evaluate2, ctx) {
   if (!path) return obj ?? {};
   const result = structuredClone(obj ?? {});
   const parts = path.split(".");
+  if (parts.some((p) => FORBIDDEN_KEYS.has(p))) {
+    return result;
+  }
   let current = result;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -1309,6 +1313,7 @@ function evalObjectDeepMerge(args, evaluate2, ctx) {
   function deepMerge(target, source) {
     const result = { ...target };
     for (const key of Object.keys(source)) {
+      if (FORBIDDEN_KEYS.has(key)) continue;
       if (source[key] !== null && typeof source[key] === "object" && !Array.isArray(source[key]) && target[key] !== null && typeof target[key] === "object" && !Array.isArray(target[key])) {
         result[key] = deepMerge(
           target[key],