@progress/kendo-angular-common 25.1.0-develop.7 → 25.1.0-develop.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1097,13 +1097,18 @@ setterCache['undefined'] = (obj) => obj;
1097
1097
  * @hidden
1098
1098
  */
1099
1099
  function setter(field) {
1100
+ const fields = [];
1101
+ if (field !== undefined) {
1102
+ field.replace(FIELD_REGEX, function (_match, index, indexAccessor, fieldName) {
1103
+ fields.push(index !== undefined ? index : (indexAccessor || fieldName));
1104
+ });
1105
+ }
1106
+ if (fields.some((item) => item === '__proto__' || item === 'constructor' || item === 'prototype')) {
1107
+ throw new Error('Field path contains a prohibited segment');
1108
+ }
1100
1109
  if (setterCache[field]) {
1101
1110
  return setterCache[field];
1102
1111
  }
1103
- const fields = [];
1104
- field.replace(FIELD_REGEX, function (_match, index, indexAccessor, fieldName) {
1105
- fields.push(index !== undefined ? index : (indexAccessor || fieldName));
1106
- });
1107
1112
  setterCache[field] = function (obj, value) {
1108
1113
  let root = obj;
1109
1114
  const depth = fields.length - 1;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@progress/kendo-angular-common",
3
- "version": "25.1.0-develop.7",
3
+ "version": "25.1.0-develop.8",
4
4
  "description": "Kendo UI for Angular - Utility Package",
5
5
  "license": "SEE LICENSE IN LICENSE.md",
6
6
  "author": "Progress",
@@ -23,7 +23,7 @@
23
23
  "@progress/kendo-common": "^1.0.1",
24
24
  "@progress/kendo-draggable": "^3.0.2",
25
25
  "tslib": "^2.3.1",
26
- "@progress/kendo-angular-schematics": "25.1.0-develop.7"
26
+ "@progress/kendo-angular-schematics": "25.1.0-develop.8"
27
27
  },
28
28
  "publishConfig": {
29
29
  "access": "public"