@gobing-ai/ts-utils 0.4.14 → 0.4.15

package/dist/object.d.ts

@@ -4,6 +4,13 @@ export declare function isPlainObject(value: unknown): value is Record<string, u
  * Recursively merge `source` into `target`, returning a new object. Nested plain objects merge;
  * arrays and scalars from `source` replace the target wholesale (a source array overrides, never
  * extends). Inputs are not mutated.
+ *
+ * A `__proto__` key in `source` is skipped: plain assignment would invoke the inherited
+ * `__proto__` setter and hand the returned object an attacker-controlled prototype, so
+ * `deepMerge(defaults, JSON.parse(userInput))` could resolve absent keys through it. Sibling
+ * keys like `constructor` need no guard here — `result` is a fresh object at every level
+ * (`{ ...target }`), so assigning them shadows an own property rather than mutating
+ * `Object.prototype`.
  */
 export declare function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown>;
 /**

package/dist/object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object.d.ts","sourceRoot":"","sources":["../src/object.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUnH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW7F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAetF"}
+{"version":3,"file":"object.d.ts","sourceRoot":"","sources":["../src/object.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWnH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW7F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAetF"}

package/dist/object.js

@@ -6,10 +6,19 @@ export function isPlainObject(value) {
  * Recursively merge `source` into `target`, returning a new object. Nested plain objects merge;
  * arrays and scalars from `source` replace the target wholesale (a source array overrides, never
  * extends). Inputs are not mutated.
+ *
+ * A `__proto__` key in `source` is skipped: plain assignment would invoke the inherited
+ * `__proto__` setter and hand the returned object an attacker-controlled prototype, so
+ * `deepMerge(defaults, JSON.parse(userInput))` could resolve absent keys through it. Sibling
+ * keys like `constructor` need no guard here — `result` is a fresh object at every level
+ * (`{ ...target }`), so assigning them shadows an own property rather than mutating
+ * `Object.prototype`.
  */
 export function deepMerge(target, source) {
     const result = { ...target };
     for (const [key, value] of Object.entries(source)) {
+        if (key === '__proto__')
+            continue;
         if (isPlainObject(value) && isPlainObject(result[key])) {
             result[key] = deepMerge(result[key], value);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-utils",
-    "version": "0.4.14",
+    "version": "0.4.15",
     "description": "Zero-dependency TypeScript utilities for dates, cursors, errors, output, origins, roles, and API responses.",
     "keywords": [
         "typescript",

package/src/object.ts

@@ -7,10 +7,18 @@ export function isPlainObject(value: unknown): value is Record<string, unknown>
  * Recursively merge `source` into `target`, returning a new object. Nested plain objects merge;
  * arrays and scalars from `source` replace the target wholesale (a source array overrides, never
  * extends). Inputs are not mutated.
+ *
+ * A `__proto__` key in `source` is skipped: plain assignment would invoke the inherited
+ * `__proto__` setter and hand the returned object an attacker-controlled prototype, so
+ * `deepMerge(defaults, JSON.parse(userInput))` could resolve absent keys through it. Sibling
+ * keys like `constructor` need no guard here — `result` is a fresh object at every level
+ * (`{ ...target }`), so assigning them shadows an own property rather than mutating
+ * `Object.prototype`.
  */
 export function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown> {
     const result = { ...target };
     for (const [key, value] of Object.entries(source)) {
+        if (key === '__proto__') continue;
         if (isPlainObject(value) && isPlainObject(result[key])) {
             result[key] = deepMerge(result[key] as Record<string, unknown>, value);
         } else {