dot-object 2.1.0 → 2.1.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # ChangeLog
 
+## 2020-09-10 Version 2.1.4
+* [[`94b9eb8a2d`](https://github.com/rhalff/dot-object/commit/94b9eb8a2d)] - Fix parsing of array paths for non standard separators (Fixed by boidolr #58)
+
+## 2020-02-16 Version 2.1.3
+* fix possible pollution of prototype for paths containing __proto__
+
+## 2019-11-02 Version 2.1.1
+* fix undefined key with root level array.
+
+## 2019-11-02 Version 2.1.1
+* Wrong array conversion when brackets are used (Reported by vladshcherbin #27)
+
 ## 2019-11-02 Version 2.1.0
 * fix delete function not being wrapped. (Reported by murphyke #40)
 

package/README.md

@@ -359,6 +359,33 @@ Result:
 }
 ```
 
+### Keep array
+
+Set keepArray to true.
+
+```javascript
+var dot = require('dot-object');
+
+var obj = {
+  id: 'my-id',
+  other: [1, 2, 3],
+  some: { array: ['A', 'B'] }
+};
+
+dot.keepArray = true;
+var tgt = dot.dot(obj);
+
+console.log(tgt);
+```
+Result:
+```json
+{
+  "id": "my-id",
+  "other": [1, 2, 3],
+  "some.array": ["A", "B"]
+}
+```
+
 ## Using a different separator
 
 If you do not like dot notation, you are free to specify a different separator.

package/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "dot-object",
-  "version": "2.1.0",
+  "version": "2.1.4",
   "description": "dot-object makes it possible to transform and read (JSON) objects using dot notation.",
   "main": "dist/dot-object.js",
   "authors": [

package/dist/dot-object.js

@@ -46,11 +46,25 @@
         return Object.keys(val).length === 0
     }
 
+    var blacklist = ['__proto__', 'prototype', 'constructor']
+    var blacklistFilter = function(part) {
+        return blacklist.indexOf(part) === -1
+    }
+
     function parsePath(path, sep) {
         if (path.indexOf('[') >= 0) {
-            path = path.replace(/\[/g, '.').replace(/]/g, '')
+            path = path.replace(/\[/g, sep).replace(/]/g, '')
+        }
+
+        var parts = path.split(sep)
+
+        var check = parts.filter(blacklistFilter)
+
+        if (check.length !== parts.length) {
+            throw Error('Refusing to update blacklisted property ' + path)
         }
-        return path.split(sep)
+
+        return parts
     }
 
     var hasOwnProperty = Object.prototype.hasOwnProperty
@@ -85,8 +99,7 @@
         var k = a.shift()
 
         if (a.length > 0) {
-            obj[k] = obj[k] ||
-                (this.useArray && isIndex(a[0]) ? [] : {})
+            obj[k] = obj[k] || (this.useArray && isIndex(a[0]) ? [] : {})
 
             if (!isArrayOrObject(obj[k])) {
                 if (this.override) {
@@ -104,8 +117,7 @@
 
             this._fill(a, obj[k], v, mod)
         } else {
-            if (!this.override &&
-                isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
+            if (!this.override && isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
                 if (!(isArrayOrObject(v) && isEmptyObject(v))) {
                     throw new Error("Trying to redefine non-empty obj['" + k + "']")
                 }
@@ -165,8 +177,10 @@
      * @param {Function|Array} mod optional modifier
      */
     DotObject.prototype.str = function(path, v, obj, mod) {
+        var ok = parsePath(path, this.separator).join(this.separator)
+
         if (path.indexOf(this.separator) !== -1) {
-            this._fill(path.split(this.separator), obj, v, mod)
+            this._fill(ok.split(this.separator), obj, v, mod)
         } else {
             obj[path] = _process(v, mod)
         }
@@ -195,7 +209,7 @@
         for (i = 0; i < keys.length; i++) {
             key = parseKey(keys[i], obj)
             if (obj && typeof obj === 'object' && key in obj) {
-                if (i === (keys.length - 1)) {
+                if (i === keys.length - 1) {
                     if (remove) {
                         val = obj[key]
                         if (reindexArray && Array.isArray(obj)) {
@@ -340,13 +354,21 @@
      * @param {Function|Array} mods
      * @param {Boolean} merge
      */
-    DotObject.prototype.transfer = function(source, target, obj1, obj2, mods, merge) {
+    DotObject.prototype.transfer = function(
+        source,
+        target,
+        obj1,
+        obj2,
+        mods,
+        merge
+    ) {
         if (typeof mods === 'function' || Array.isArray(mods)) {
-            this.set(target,
-                _process(
-                    this.pick(source, obj1, true),
-                    mods
-                ), obj2, merge)
+            this.set(
+                target,
+                _process(this.pick(source, obj1, true), mods),
+                obj2,
+                merge
+            )
         } else {
             merge = mods
             this.set(target, this.pick(source, obj1, true), obj2, merge)
@@ -371,16 +393,16 @@
      */
     DotObject.prototype.copy = function(source, target, obj1, obj2, mods, merge) {
         if (typeof mods === 'function' || Array.isArray(mods)) {
-            this.set(target,
+            this.set(
+                target,
                 _process(
                     // clone what is picked
-                    JSON.parse(
-                        JSON.stringify(
-                            this.pick(source, obj1, false)
-                        )
-                    ),
+                    JSON.parse(JSON.stringify(this.pick(source, obj1, false))),
                     mods
-                ), obj2, merge)
+                ),
+                obj2,
+                merge
+            )
         } else {
             merge = mods
             this.set(target, this.pick(source, obj1, false), obj2, merge)
@@ -412,7 +434,7 @@
 
         for (i = 0; i < keys.length; i++) {
             key = keys[i]
-            if (i === (keys.length - 1)) {
+            if (i === keys.length - 1) {
                 if (merge && isObject(val) && isObject(obj[key])) {
                     for (k in val) {
                         if (hasOwnProperty.call(val, k)) {
@@ -470,9 +492,11 @@
     DotObject.prototype.transform = function(recipe, obj, tgt) {
         obj = obj || {}
         tgt = tgt || {}
-        Object.keys(recipe).forEach(function(key) {
-            this.set(recipe[key], this.pick(key, obj), tgt)
-        }.bind(this))
+        Object.keys(recipe).forEach(
+            function(key) {
+                this.set(recipe[key], this.pick(key, obj), tgt)
+            }.bind(this)
+        )
         return tgt
     }
 
@@ -498,30 +522,33 @@
         path = path || []
         var isArray = Array.isArray(obj)
 
-        Object.keys(obj).forEach(function(key) {
-            var index = isArray && this.useBrackets ? '[' + key + ']' : key
-            if (
-                (
+        Object.keys(obj).forEach(
+            function(key) {
+                var index = isArray && this.useBrackets ? '[' + key + ']' : key
+                if (
                     isArrayOrObject(obj[key]) &&
-                    (
-                        (isObject(obj[key]) && !isEmptyObject(obj[key])) ||
-                        (Array.isArray(obj[key]) && (!this.keepArray && (obj[key].length !== 0)))
-                    )
-                )
-            ) {
-                if (isArray && this.useBrackets) {
-                    return this.dot(obj[key], tgt, path.slice(0, -1).concat(path[path.length - 1] + index))
-                } else {
-                    return this.dot(obj[key], tgt, path.concat(index))
-                }
-            } else {
-                if (isArray && this.useBrackets) {
-                    tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+                    ((isObject(obj[key]) && !isEmptyObject(obj[key])) ||
+                        (Array.isArray(obj[key]) && !this.keepArray && obj[key].length !== 0))
+                ) {
+                    if (isArray && this.useBrackets) {
+                        var previousKey = path[path.length - 1] || ''
+                        return this.dot(
+                            obj[key],
+                            tgt,
+                            path.slice(0, -1).concat(previousKey + index)
+                        )
+                    } else {
+                        return this.dot(obj[key], tgt, path.concat(index))
+                    }
                 } else {
-                    tgt[path.concat(index).join(this.separator)] = obj[key]
+                    if (isArray && this.useBrackets) {
+                        tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+                    } else {
+                        tgt[path.concat(index).join(this.separator)] = obj[key]
+                    }
                 }
-            }
-        }.bind(this))
+            }.bind(this)
+        )
         return tgt
     }
 
@@ -535,9 +562,7 @@
     DotObject.set = wrap('set')
     DotObject.delete = wrap('delete')
     DotObject.del = DotObject.remove = wrap('remove')
-    DotObject.dot = wrap('dot')
-
-    ;
+    DotObject.dot = wrap('dot');
     ['override', 'overwrite'].forEach(function(prop) {
         Object.defineProperty(DotObject, prop, {
             get: function() {
@@ -547,9 +572,7 @@
                 dotDefault.override = !!val
             }
         })
-    })
-
-    ;
+    });
     ['useArray', 'keepArray', 'useBrackets'].forEach(function(prop) {
         Object.defineProperty(DotObject, prop, {
             get: function() {

package/dist/dot-object.min.js

@@ -1 +1 @@
-!function(t){"use strict";function s(t,r){var e,i;if("function"==typeof r)void 0!==(i=r(t))&&(t=i);else if(Array.isArray(r))for(e=0;e<r.length;e++)void 0!==(i=r[e](t))&&(t=i);return t}function f(t){return"[object Object]"===Object.prototype.toString.call(t)}function c(t){return Object(t)===t}function a(t){return 0===Object.keys(t).length}function u(t,r){return 0<=t.indexOf("[")&&(t=t.replace(/\[/g,".").replace(/]/g,"")),t.split(r)}var p=Object.prototype.hasOwnProperty;function n(t,r,e,i){if(!(this instanceof n))return new n(t,r,e,i);void 0===r&&(r=!1),void 0===e&&(e=!0),void 0===i&&(i=!0),this.separator=t||".",this.override=r,this.useArray=e,this.useBrackets=i,this.keepArray=!1,this.cleanup=[]}var e=new n(".",!1,!0,!0);function r(t){return function(){return e[t].apply(e,arguments)}}n.prototype._fill=function(t,r,e,i){var n=t.shift();if(0<t.length){if(r[n]=r[n]||(this.useArray&&function(t){return/^\d+$/.test(t)}(t[0])?[]:{}),!c(r[n])){if(!this.override){if(!c(e)||!a(e))throw new Error("Trying to redefine `"+n+"` which is a "+typeof r[n]);return}r[n]={}}this._fill(t,r[n],e,i)}else{if(!this.override&&c(r[n])&&!a(r[n])){if(!c(e)||!a(e))throw new Error("Trying to redefine non-empty obj['"+n+"']");return}r[n]=s(e,i)}},n.prototype.object=function(i,n){var o=this;return Object.keys(i).forEach(function(t){var r=void 0===n?null:n[t],e=u(t,o.separator).join(o.separator);-1!==e.indexOf(o.separator)?(o._fill(e.split(o.separator),i,i[t],r),delete i[t]):i[t]=s(i[t],r)}),i},n.prototype.str=function(t,r,e,i){return-1!==t.indexOf(this.separator)?this._fill(t.split(this.separator),e,r,i):e[t]=s(r,i),e},n.prototype.pick=function(t,r,e,i){var n,o,s,c,a,f,p;for(o=u(t,this.separator),n=0;n<o.length;n++){if(f=o[n],p=r,c="-"===f[0]&&Array.isArray(p)&&/^-\d+$/.test(f)?p.length+parseInt(f,10):f,!(r&&"object"==typeof r&&c in r))return;if(n===o.length-1)return e?(s=r[c],i&&Array.isArray(r)?r.splice(c,1):delete r[c],Array.isArray(r)&&(a=o.slice(0,-1).join("."),-1===this.cleanup.indexOf(a)&&this.cleanup.push(a)),s):r[c];r=r[c]}return e&&Array.isArray(r)&&(r=r.filter(function(t){return void 0!==t})),r},n.prototype.delete=function(t,r){return this.remove(t,r,!0)},n.prototype.remove=function(t,r,e){var i;if(this.cleanup=[],Array.isArray(t)){for(i=0;i<t.length;i++)this.pick(t[i],r,!0,e);return e||this._cleanup(r),r}return this.pick(t,r,!0,e)},n.prototype._cleanup=function(t){var r,e,i,n;if(this.cleanup.length){for(e=0;e<this.cleanup.length;e++)r=(r=(n=(i=this.cleanup[e].split(".")).splice(0,-1).join("."))?this.pick(n,t):t)[i[0]].filter(function(t){return void 0!==t}),this.set(this.cleanup[e],r,t);this.cleanup=[]}},n.prototype.del=n.prototype.remove,n.prototype.move=function(t,r,e,i,n){return"function"==typeof i||Array.isArray(i)?this.set(r,s(this.pick(t,e,!0),i),e,n):(n=i,this.set(r,this.pick(t,e,!0),e,n)),e},n.prototype.transfer=function(t,r,e,i,n,o){return"function"==typeof n||Array.isArray(n)?this.set(r,s(this.pick(t,e,!0),n),i,o):(o=n,this.set(r,this.pick(t,e,!0),i,o)),i},n.prototype.copy=function(t,r,e,i,n,o){return"function"==typeof n||Array.isArray(n)?this.set(r,s(JSON.parse(JSON.stringify(this.pick(t,e,!1))),n),i,o):(o=n,this.set(r,this.pick(t,e,!1),i,o)),i},n.prototype.set=function(t,r,e,i){var n,o,s,c;if(void 0===r)return e;for(s=u(t,this.separator),n=0;n<s.length;n++){if(c=s[n],n===s.length-1)if(i&&f(r)&&f(e[c]))for(o in r)p.call(r,o)&&(e[c][o]=r[o]);else if(i&&Array.isArray(e[c])&&Array.isArray(r))for(var a=0;a<r.length;a++)e[s[n]].push(r[a]);else e[c]=r;else p.call(e,c)&&(f(e[c])||Array.isArray(e[c]))||(/^\d+$/.test(s[n+1])?e[c]=[]:e[c]={});e=e[c]}return e},n.prototype.transform=function(r,e,i){return e=e||{},i=i||{},Object.keys(r).forEach(function(t){this.set(r[t],this.pick(t,e),i)}.bind(this)),i},n.prototype.dot=function(e,i,n){i=i||{},n=n||[];var o=Array.isArray(e);return Object.keys(e).forEach(function(t){var r=o&&this.useBrackets?"["+t+"]":t;if(c(e[t])&&(f(e[t])&&!a(e[t])||Array.isArray(e[t])&&!this.keepArray&&0!==e[t].length))return o&&this.useBrackets?this.dot(e[t],i,n.slice(0,-1).concat(n[n.length-1]+r)):this.dot(e[t],i,n.concat(r));o&&this.useBrackets?i[n.join(this.separator).concat("["+t+"]")]=e[t]:i[n.concat(r).join(this.separator)]=e[t]}.bind(this)),i},n.pick=r("pick"),n.move=r("move"),n.transfer=r("transfer"),n.transform=r("transform"),n.copy=r("copy"),n.object=r("object"),n.str=r("str"),n.set=r("set"),n.delete=r("delete"),n.del=n.remove=r("remove"),n.dot=r("dot"),["override","overwrite"].forEach(function(t){Object.defineProperty(n,t,{get:function(){return e.override},set:function(t){e.override=!!t}})}),["useArray","keepArray","useBrackets"].forEach(function(r){Object.defineProperty(n,r,{get:function(){return e[r]},set:function(t){e[r]=t}})}),n._process=s,"function"==typeof define&&define.amd?define(function(){return n}):"undefined"!=typeof module&&module.exports?module.exports=n:t.DotObject=n}(this);
+!function(t){"use strict";function s(t,r){var e,i;if("function"==typeof r)void 0!==(i=r(t))&&(t=i);else if(Array.isArray(r))for(e=0;e<r.length;e++)void 0!==(i=r[e](t))&&(t=i);return t}function p(t){return"[object Object]"===Object.prototype.toString.call(t)}function a(t){return Object(t)===t}function c(t){return 0===Object.keys(t).length}function i(t){return-1===r.indexOf(t)}var r=["__proto__","prototype","constructor"];function u(t,r){0<=t.indexOf("[")&&(t=t.replace(/\[/g,r).replace(/]/g,""));var e=t.split(r);if(e.filter(i).length!==e.length)throw Error("Refusing to update blacklisted property "+t);return e}var f=Object.prototype.hasOwnProperty;function n(t,r,e,i){if(!(this instanceof n))return new n(t,r,e,i);void 0===r&&(r=!1),void 0===e&&(e=!0),void 0===i&&(i=!0),this.separator=t||".",this.override=r,this.useArray=e,this.useBrackets=i,this.keepArray=!1,this.cleanup=[]}var e=new n(".",!1,!0,!0);function o(t){return function(){return e[t].apply(e,arguments)}}n.prototype._fill=function(t,r,e,i){var n=t.shift();if(0<t.length){if(r[n]=r[n]||(this.useArray&&function(t){return/^\d+$/.test(t)}(t[0])?[]:{}),!a(r[n])){if(!this.override){if(!a(e)||!c(e))throw new Error("Trying to redefine `"+n+"` which is a "+typeof r[n]);return}r[n]={}}this._fill(t,r[n],e,i)}else{if(!this.override&&a(r[n])&&!c(r[n])){if(!a(e)||!c(e))throw new Error("Trying to redefine non-empty obj['"+n+"']");return}r[n]=s(e,i)}},n.prototype.object=function(i,n){var o=this;return Object.keys(i).forEach(function(t){var r=void 0===n?null:n[t],e=u(t,o.separator).join(o.separator);-1!==e.indexOf(o.separator)?(o._fill(e.split(o.separator),i,i[t],r),delete i[t]):i[t]=s(i[t],r)}),i},n.prototype.str=function(t,r,e,i){var n=u(t,this.separator).join(this.separator);return-1!==t.indexOf(this.separator)?this._fill(n.split(this.separator),e,r,i):e[t]=s(r,i),e},n.prototype.pick=function(t,r,e,i){var n,o,s,a,c,p,f;for(o=u(t,this.separator),n=0;n<o.length;n++){if(p=o[n],f=r,a="-"===p[0]&&Array.isArray(f)&&/^-\d+$/.test(p)?f.length+parseInt(p,10):p,!(r&&"object"==typeof r&&a in r))return;if(n===o.length-1)return e?(s=r[a],i&&Array.isArray(r)?r.splice(a,1):delete r[a],Array.isArray(r)&&(c=o.slice(0,-1).join("."),-1===this.cleanup.indexOf(c)&&this.cleanup.push(c)),s):r[a];r=r[a]}return e&&Array.isArray(r)&&(r=r.filter(function(t){return void 0!==t})),r},n.prototype.delete=function(t,r){return this.remove(t,r,!0)},n.prototype.remove=function(t,r,e){var i;if(this.cleanup=[],Array.isArray(t)){for(i=0;i<t.length;i++)this.pick(t[i],r,!0,e);return e||this._cleanup(r),r}return this.pick(t,r,!0,e)},n.prototype._cleanup=function(t){var r,e,i,n;if(this.cleanup.length){for(e=0;e<this.cleanup.length;e++)r=(r=(n=(i=this.cleanup[e].split(".")).splice(0,-1).join("."))?this.pick(n,t):t)[i[0]].filter(function(t){return void 0!==t}),this.set(this.cleanup[e],r,t);this.cleanup=[]}},n.prototype.del=n.prototype.remove,n.prototype.move=function(t,r,e,i,n){return"function"==typeof i||Array.isArray(i)?this.set(r,s(this.pick(t,e,!0),i),e,n):(n=i,this.set(r,this.pick(t,e,!0),e,n)),e},n.prototype.transfer=function(t,r,e,i,n,o){return"function"==typeof n||Array.isArray(n)?this.set(r,s(this.pick(t,e,!0),n),i,o):(o=n,this.set(r,this.pick(t,e,!0),i,o)),i},n.prototype.copy=function(t,r,e,i,n,o){return"function"==typeof n||Array.isArray(n)?this.set(r,s(JSON.parse(JSON.stringify(this.pick(t,e,!1))),n),i,o):(o=n,this.set(r,this.pick(t,e,!1),i,o)),i},n.prototype.set=function(t,r,e,i){var n,o,s,a;if(void 0===r)return e;for(s=u(t,this.separator),n=0;n<s.length;n++){if(a=s[n],n===s.length-1)if(i&&p(r)&&p(e[a]))for(o in r)f.call(r,o)&&(e[a][o]=r[o]);else if(i&&Array.isArray(e[a])&&Array.isArray(r))for(var c=0;c<r.length;c++)e[s[n]].push(r[c]);else e[a]=r;else f.call(e,a)&&(p(e[a])||Array.isArray(e[a]))||(/^\d+$/.test(s[n+1])?e[a]=[]:e[a]={});e=e[a]}return e},n.prototype.transform=function(r,e,i){return e=e||{},i=i||{},Object.keys(r).forEach(function(t){this.set(r[t],this.pick(t,e),i)}.bind(this)),i},n.prototype.dot=function(i,n,o){n=n||{},o=o||[];var s=Array.isArray(i);return Object.keys(i).forEach(function(t){var r=s&&this.useBrackets?"["+t+"]":t;if(a(i[t])&&(p(i[t])&&!c(i[t])||Array.isArray(i[t])&&!this.keepArray&&0!==i[t].length)){if(s&&this.useBrackets){var e=o[o.length-1]||"";return this.dot(i[t],n,o.slice(0,-1).concat(e+r))}return this.dot(i[t],n,o.concat(r))}s&&this.useBrackets?n[o.join(this.separator).concat("["+t+"]")]=i[t]:n[o.concat(r).join(this.separator)]=i[t]}.bind(this)),n},n.pick=o("pick"),n.move=o("move"),n.transfer=o("transfer"),n.transform=o("transform"),n.copy=o("copy"),n.object=o("object"),n.str=o("str"),n.set=o("set"),n.delete=o("delete"),n.del=n.remove=o("remove"),n.dot=o("dot"),["override","overwrite"].forEach(function(t){Object.defineProperty(n,t,{get:function(){return e.override},set:function(t){e.override=!!t}})}),["useArray","keepArray","useBrackets"].forEach(function(r){Object.defineProperty(n,r,{get:function(){return e[r]},set:function(t){e[r]=t}})}),n._process=s,"function"==typeof define&&define.amd?define(function(){return n}):"undefined"!=typeof module&&module.exports?module.exports=n:t.DotObject=n}(this);

package/index.js

@@ -45,11 +45,23 @@ function isEmptyObject (val) {
   return Object.keys(val).length === 0
 }
 
+var blacklist = ['__proto__', 'prototype', 'constructor']
+var blacklistFilter = function (part) { return blacklist.indexOf(part) === -1 }
+
 function parsePath (path, sep) {
   if (path.indexOf('[') >= 0) {
-    path = path.replace(/\[/g, '.').replace(/]/g, '')
+    path = path.replace(/\[/g, sep).replace(/]/g, '')
+  }
+
+  var parts = path.split(sep)
+
+  var check = parts.filter(blacklistFilter)
+
+  if (check.length !== parts.length) {
+    throw Error('Refusing to update blacklisted property ' + path)
   }
-  return path.split(sep)
+
+  return parts
 }
 
 var hasOwnProperty = Object.prototype.hasOwnProperty
@@ -83,8 +95,7 @@ DotObject.prototype._fill = function (a, obj, v, mod) {
   var k = a.shift()
 
   if (a.length > 0) {
-    obj[k] = obj[k] ||
-      (this.useArray && isIndex(a[0]) ? [] : {})
+    obj[k] = obj[k] || (this.useArray && isIndex(a[0]) ? [] : {})
 
     if (!isArrayOrObject(obj[k])) {
       if (this.override) {
@@ -102,8 +113,7 @@ DotObject.prototype._fill = function (a, obj, v, mod) {
 
     this._fill(a, obj[k], v, mod)
   } else {
-    if (!this.override &&
-      isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
+    if (!this.override && isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
       if (!(isArrayOrObject(v) && isEmptyObject(v))) {
         throw new Error("Trying to redefine non-empty obj['" + k + "']")
       }
@@ -163,8 +173,10 @@ DotObject.prototype.object = function (obj, mods) {
  * @param {Function|Array} mod optional modifier
  */
 DotObject.prototype.str = function (path, v, obj, mod) {
+  var ok = parsePath(path, this.separator).join(this.separator)
+
   if (path.indexOf(this.separator) !== -1) {
-    this._fill(path.split(this.separator), obj, v, mod)
+    this._fill(ok.split(this.separator), obj, v, mod)
   } else {
     obj[path] = _process(v, mod)
   }
@@ -193,7 +205,7 @@ DotObject.prototype.pick = function (path, obj, remove, reindexArray) {
   for (i = 0; i < keys.length; i++) {
     key = parseKey(keys[i], obj)
     if (obj && typeof obj === 'object' && key in obj) {
-      if (i === (keys.length - 1)) {
+      if (i === keys.length - 1) {
         if (remove) {
           val = obj[key]
           if (reindexArray && Array.isArray(obj)) {
@@ -219,7 +231,9 @@ DotObject.prototype.pick = function (path, obj, remove, reindexArray) {
     }
   }
   if (remove && Array.isArray(obj)) {
-    obj = obj.filter(function (n) { return n !== undefined })
+    obj = obj.filter(function (n) {
+      return n !== undefined
+    })
   }
   return obj
 }
@@ -277,7 +291,9 @@ DotObject.prototype._cleanup = function (obj) {
       keys = this.cleanup[i].split('.')
       root = keys.splice(0, -1).join('.')
       ret = root ? this.pick(root, obj) : obj
-      ret = ret[keys[0]].filter(function (v) { return v !== undefined })
+      ret = ret[keys[0]].filter(function (v) {
+        return v !== undefined
+      })
       this.set(this.cleanup[i], ret, obj)
     }
     this.cleanup = []
@@ -334,13 +350,21 @@ DotObject.prototype.move = function (source, target, obj, mods, merge) {
  * @param {Function|Array} mods
  * @param {Boolean} merge
  */
-DotObject.prototype.transfer = function (source, target, obj1, obj2, mods, merge) {
+DotObject.prototype.transfer = function (
+  source,
+  target,
+  obj1,
+  obj2,
+  mods,
+  merge
+) {
   if (typeof mods === 'function' || Array.isArray(mods)) {
-    this.set(target,
-      _process(
-        this.pick(source, obj1, true),
-        mods
-      ), obj2, merge)
+    this.set(
+      target,
+      _process(this.pick(source, obj1, true), mods),
+      obj2,
+      merge
+    )
   } else {
     merge = mods
     this.set(target, this.pick(source, obj1, true), obj2, merge)
@@ -365,16 +389,16 @@ DotObject.prototype.transfer = function (source, target, obj1, obj2, mods, merge
  */
 DotObject.prototype.copy = function (source, target, obj1, obj2, mods, merge) {
   if (typeof mods === 'function' || Array.isArray(mods)) {
-    this.set(target,
+    this.set(
+      target,
       _process(
         // clone what is picked
-        JSON.parse(
-          JSON.stringify(
-            this.pick(source, obj1, false)
-          )
-        ),
+        JSON.parse(JSON.stringify(this.pick(source, obj1, false))),
         mods
-      ), obj2, merge)
+      ),
+      obj2,
+      merge
+    )
   } else {
     merge = mods
     this.set(target, this.pick(source, obj1, false), obj2, merge)
@@ -406,7 +430,7 @@ DotObject.prototype.set = function (path, val, obj, merge) {
 
   for (i = 0; i < keys.length; i++) {
     key = keys[i]
-    if (i === (keys.length - 1)) {
+    if (i === keys.length - 1) {
       if (merge && isObject(val) && isObject(obj[key])) {
         for (k in val) {
           if (hasOwnProperty.call(val, k)) {
@@ -445,14 +469,14 @@ DotObject.prototype.set = function (path, val, obj, merge) {
  *
  *   var obj = {
  *     "id": 1,
-  *    "some": {
-  *      "thing": "else"
-  *    }
+ *    "some": {
+ *      "thing": "else"
+ *    }
  *   }
  *
  *   var transform = {
  *     "id": "nr",
-  *    "some.thing": "name"
+ *    "some.thing": "name"
  *   }
  *
  *   var tgt = dot.transform(transform, obj)
@@ -464,9 +488,11 @@ DotObject.prototype.set = function (path, val, obj, merge) {
 DotObject.prototype.transform = function (recipe, obj, tgt) {
   obj = obj || {}
   tgt = tgt || {}
-  Object.keys(recipe).forEach(function (key) {
-    this.set(recipe[key], this.pick(key, obj), tgt)
-  }.bind(this))
+  Object.keys(recipe).forEach(
+    function (key) {
+      this.set(recipe[key], this.pick(key, obj), tgt)
+    }.bind(this)
+  )
   return tgt
 }
 
@@ -492,30 +518,33 @@ DotObject.prototype.dot = function (obj, tgt, path) {
   path = path || []
   var isArray = Array.isArray(obj)
 
-  Object.keys(obj).forEach(function (key) {
-    var index = isArray && this.useBrackets ? '[' + key + ']' : key
-    if (
-      (
+  Object.keys(obj).forEach(
+    function (key) {
+      var index = isArray && this.useBrackets ? '[' + key + ']' : key
+      if (
         isArrayOrObject(obj[key]) &&
-        (
-          (isObject(obj[key]) && !isEmptyObject(obj[key])) ||
-          (Array.isArray(obj[key]) && (!this.keepArray && (obj[key].length !== 0)))
-        )
-      )
-    ) {
-      if (isArray && this.useBrackets) {
-        return this.dot(obj[key], tgt, path.slice(0, -1).concat(path[path.length - 1] + index))
-      } else {
-        return this.dot(obj[key], tgt, path.concat(index))
-      }
-    } else {
-      if (isArray && this.useBrackets) {
-        tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+        ((isObject(obj[key]) && !isEmptyObject(obj[key])) ||
+          (Array.isArray(obj[key]) && !this.keepArray && obj[key].length !== 0))
+      ) {
+        if (isArray && this.useBrackets) {
+          var previousKey = path[path.length - 1] || ''
+          return this.dot(
+            obj[key],
+            tgt,
+            path.slice(0, -1).concat(previousKey + index)
+          )
+        } else {
+          return this.dot(obj[key], tgt, path.concat(index))
+        }
       } else {
-        tgt[path.concat(index).join(this.separator)] = obj[key]
+        if (isArray && this.useBrackets) {
+          tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+        } else {
+          tgt[path.concat(index).join(this.separator)] = obj[key]
+        }
       }
-    }
-  }.bind(this))
+    }.bind(this)
+  )
   return tgt
 }
 
@@ -529,9 +558,8 @@ DotObject.str = wrap('str')
 DotObject.set = wrap('set')
 DotObject.delete = wrap('delete')
 DotObject.del = DotObject.remove = wrap('remove')
-DotObject.dot = wrap('dot')
-
-;['override', 'overwrite'].forEach(function (prop) {
+DotObject.dot = wrap('dot');
+['override', 'overwrite'].forEach(function (prop) {
   Object.defineProperty(DotObject, prop, {
     get: function () {
       return dotDefault.override
@@ -540,9 +568,8 @@ DotObject.dot = wrap('dot')
       dotDefault.override = !!val
     }
   })
-})
-
-;['useArray', 'keepArray', 'useBrackets'].forEach(function (prop) {
+});
+['useArray', 'keepArray', 'useBrackets'].forEach(function (prop) {
   Object.defineProperty(DotObject, prop, {
     get: function () {
       return dotDefault[prop]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dot-object",
   "description": "dot-object makes it possible to transform and read (JSON) objects using dot notation.",
-  "version": "2.1.0",
+  "version": "2.1.4",
   "author": {
     "name": "Rob Halff",
     "email": "rob.halff@gmail.com"

package/src/dot-object.js

@@ -45,11 +45,23 @@ function isEmptyObject (val) {
   return Object.keys(val).length === 0
 }
 
+var blacklist = ['__proto__', 'prototype', 'constructor']
+var blacklistFilter = function (part) { return blacklist.indexOf(part) === -1 }
+
 function parsePath (path, sep) {
   if (path.indexOf('[') >= 0) {
-    path = path.replace(/\[/g, '.').replace(/]/g, '')
+    path = path.replace(/\[/g, sep).replace(/]/g, '')
+  }
+
+  var parts = path.split(sep)
+
+  var check = parts.filter(blacklistFilter)
+
+  if (check.length !== parts.length) {
+    throw Error('Refusing to update blacklisted property ' + path)
   }
-  return path.split(sep)
+
+  return parts
 }
 
 var hasOwnProperty = Object.prototype.hasOwnProperty
@@ -83,8 +95,7 @@ DotObject.prototype._fill = function (a, obj, v, mod) {
   var k = a.shift()
 
   if (a.length > 0) {
-    obj[k] = obj[k] ||
-      (this.useArray && isIndex(a[0]) ? [] : {})
+    obj[k] = obj[k] || (this.useArray && isIndex(a[0]) ? [] : {})
 
     if (!isArrayOrObject(obj[k])) {
       if (this.override) {
@@ -102,8 +113,7 @@ DotObject.prototype._fill = function (a, obj, v, mod) {
 
     this._fill(a, obj[k], v, mod)
   } else {
-    if (!this.override &&
-      isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
+    if (!this.override && isArrayOrObject(obj[k]) && !isEmptyObject(obj[k])) {
       if (!(isArrayOrObject(v) && isEmptyObject(v))) {
         throw new Error("Trying to redefine non-empty obj['" + k + "']")
       }
@@ -163,8 +173,10 @@ DotObject.prototype.object = function (obj, mods) {
  * @param {Function|Array} mod optional modifier
  */
 DotObject.prototype.str = function (path, v, obj, mod) {
+  var ok = parsePath(path, this.separator).join(this.separator)
+
   if (path.indexOf(this.separator) !== -1) {
-    this._fill(path.split(this.separator), obj, v, mod)
+    this._fill(ok.split(this.separator), obj, v, mod)
   } else {
     obj[path] = _process(v, mod)
   }
@@ -193,7 +205,7 @@ DotObject.prototype.pick = function (path, obj, remove, reindexArray) {
   for (i = 0; i < keys.length; i++) {
     key = parseKey(keys[i], obj)
     if (obj && typeof obj === 'object' && key in obj) {
-      if (i === (keys.length - 1)) {
+      if (i === keys.length - 1) {
         if (remove) {
           val = obj[key]
           if (reindexArray && Array.isArray(obj)) {
@@ -219,7 +231,9 @@ DotObject.prototype.pick = function (path, obj, remove, reindexArray) {
     }
   }
   if (remove && Array.isArray(obj)) {
-    obj = obj.filter(function (n) { return n !== undefined })
+    obj = obj.filter(function (n) {
+      return n !== undefined
+    })
   }
   return obj
 }
@@ -277,7 +291,9 @@ DotObject.prototype._cleanup = function (obj) {
       keys = this.cleanup[i].split('.')
       root = keys.splice(0, -1).join('.')
       ret = root ? this.pick(root, obj) : obj
-      ret = ret[keys[0]].filter(function (v) { return v !== undefined })
+      ret = ret[keys[0]].filter(function (v) {
+        return v !== undefined
+      })
       this.set(this.cleanup[i], ret, obj)
     }
     this.cleanup = []
@@ -334,13 +350,21 @@ DotObject.prototype.move = function (source, target, obj, mods, merge) {
  * @param {Function|Array} mods
  * @param {Boolean} merge
  */
-DotObject.prototype.transfer = function (source, target, obj1, obj2, mods, merge) {
+DotObject.prototype.transfer = function (
+  source,
+  target,
+  obj1,
+  obj2,
+  mods,
+  merge
+) {
   if (typeof mods === 'function' || Array.isArray(mods)) {
-    this.set(target,
-      _process(
-        this.pick(source, obj1, true),
-        mods
-      ), obj2, merge)
+    this.set(
+      target,
+      _process(this.pick(source, obj1, true), mods),
+      obj2,
+      merge
+    )
   } else {
     merge = mods
     this.set(target, this.pick(source, obj1, true), obj2, merge)
@@ -365,16 +389,16 @@ DotObject.prototype.transfer = function (source, target, obj1, obj2, mods, merge
  */
 DotObject.prototype.copy = function (source, target, obj1, obj2, mods, merge) {
   if (typeof mods === 'function' || Array.isArray(mods)) {
-    this.set(target,
+    this.set(
+      target,
       _process(
         // clone what is picked
-        JSON.parse(
-          JSON.stringify(
-            this.pick(source, obj1, false)
-          )
-        ),
+        JSON.parse(JSON.stringify(this.pick(source, obj1, false))),
         mods
-      ), obj2, merge)
+      ),
+      obj2,
+      merge
+    )
   } else {
     merge = mods
     this.set(target, this.pick(source, obj1, false), obj2, merge)
@@ -406,7 +430,7 @@ DotObject.prototype.set = function (path, val, obj, merge) {
 
   for (i = 0; i < keys.length; i++) {
     key = keys[i]
-    if (i === (keys.length - 1)) {
+    if (i === keys.length - 1) {
       if (merge && isObject(val) && isObject(obj[key])) {
         for (k in val) {
           if (hasOwnProperty.call(val, k)) {
@@ -445,14 +469,14 @@ DotObject.prototype.set = function (path, val, obj, merge) {
  *
  *   var obj = {
  *     "id": 1,
-  *    "some": {
-  *      "thing": "else"
-  *    }
+ *    "some": {
+ *      "thing": "else"
+ *    }
  *   }
  *
  *   var transform = {
  *     "id": "nr",
-  *    "some.thing": "name"
+ *    "some.thing": "name"
  *   }
  *
  *   var tgt = dot.transform(transform, obj)
@@ -464,9 +488,11 @@ DotObject.prototype.set = function (path, val, obj, merge) {
 DotObject.prototype.transform = function (recipe, obj, tgt) {
   obj = obj || {}
   tgt = tgt || {}
-  Object.keys(recipe).forEach(function (key) {
-    this.set(recipe[key], this.pick(key, obj), tgt)
-  }.bind(this))
+  Object.keys(recipe).forEach(
+    function (key) {
+      this.set(recipe[key], this.pick(key, obj), tgt)
+    }.bind(this)
+  )
   return tgt
 }
 
@@ -492,30 +518,33 @@ DotObject.prototype.dot = function (obj, tgt, path) {
   path = path || []
   var isArray = Array.isArray(obj)
 
-  Object.keys(obj).forEach(function (key) {
-    var index = isArray && this.useBrackets ? '[' + key + ']' : key
-    if (
-      (
+  Object.keys(obj).forEach(
+    function (key) {
+      var index = isArray && this.useBrackets ? '[' + key + ']' : key
+      if (
         isArrayOrObject(obj[key]) &&
-        (
-          (isObject(obj[key]) && !isEmptyObject(obj[key])) ||
-          (Array.isArray(obj[key]) && (!this.keepArray && (obj[key].length !== 0)))
-        )
-      )
-    ) {
-      if (isArray && this.useBrackets) {
-        return this.dot(obj[key], tgt, path.slice(0, -1).concat(path[path.length - 1] + index))
-      } else {
-        return this.dot(obj[key], tgt, path.concat(index))
-      }
-    } else {
-      if (isArray && this.useBrackets) {
-        tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+        ((isObject(obj[key]) && !isEmptyObject(obj[key])) ||
+          (Array.isArray(obj[key]) && !this.keepArray && obj[key].length !== 0))
+      ) {
+        if (isArray && this.useBrackets) {
+          var previousKey = path[path.length - 1] || ''
+          return this.dot(
+            obj[key],
+            tgt,
+            path.slice(0, -1).concat(previousKey + index)
+          )
+        } else {
+          return this.dot(obj[key], tgt, path.concat(index))
+        }
       } else {
-        tgt[path.concat(index).join(this.separator)] = obj[key]
+        if (isArray && this.useBrackets) {
+          tgt[path.join(this.separator).concat('[' + key + ']')] = obj[key]
+        } else {
+          tgt[path.concat(index).join(this.separator)] = obj[key]
+        }
       }
-    }
-  }.bind(this))
+    }.bind(this)
+  )
   return tgt
 }
 
@@ -529,9 +558,8 @@ DotObject.str = wrap('str')
 DotObject.set = wrap('set')
 DotObject.delete = wrap('delete')
 DotObject.del = DotObject.remove = wrap('remove')
-DotObject.dot = wrap('dot')
-
-;['override', 'overwrite'].forEach(function (prop) {
+DotObject.dot = wrap('dot');
+['override', 'overwrite'].forEach(function (prop) {
   Object.defineProperty(DotObject, prop, {
     get: function () {
       return dotDefault.override
@@ -540,9 +568,8 @@ DotObject.dot = wrap('dot')
       dotDefault.override = !!val
     }
   })
-})
-
-;['useArray', 'keepArray', 'useBrackets'].forEach(function (prop) {
+});
+['useArray', 'keepArray', 'useBrackets'].forEach(function (prop) {
   Object.defineProperty(DotObject, prop, {
     get: function () {
       return dotDefault[prop]

package/test/array_notation.js

@@ -167,4 +167,10 @@ describe('Dotted Array notation', function () {
   describe('with bracket notation', function () {
     runVariant('bracket')
   })
+
+  describe('Refuse to update __proto__', function () {
+    var obj = { path: [] }
+
+    ;(() => Dot.set('path[0].__proto__.toString', 'test', obj)).should.throw(/Refusing to update/)
+  })
 })

package/test/dot-json.js

@@ -55,6 +55,28 @@ describe('Object test:', function () {
     })
   })
 
+  it('Should expand dotted keys with array notation with different separator', function () {
+    var row = {
+      id: 2,
+      my_arr_0: 'one',
+      my_arr_1: 'two',
+      my_arr_2: 'three',
+      'my_arr2[0]': 'one',
+      'my_arr2[1]': 'two',
+      'my_arr2[2]': 'three'
+    }
+
+    new Dot('_').object(row)
+
+    row.should.eql({
+      id: 2,
+      my: {
+        arr: ['one', 'two', 'three'],
+        arr2: ['one', 'two', 'three']
+      }
+    })
+  })
+
   it('Should allow keys with numbers', function () {
     var row = {
       id: 2,
@@ -205,4 +227,11 @@ describe('Object test:', function () {
 
     row.should.eql({ page: { name: 'my_page' } })
   })
+
+  it('Dot.object should disallow to set __proto__', function () {
+    var row = { '__proto__.toString': 'hi' }
+
+    var dot = new Dot()
+    ;(() => dot.object(row)).should.throw(/Refusing to update/)
+  })
 })

package/test/dot.js

@@ -7,6 +7,8 @@ var pkg = require('./fixtures/package.json')
 describe('dot():', function () {
   var obj
 
+  // Dot.useBrackets = false;
+
   beforeEach(function () {
     obj = {
       id: 'my-id',
@@ -36,7 +38,25 @@ describe('dot():', function () {
       ehrm: 123,
       dates: {
         first: new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)')
-      }
+      },
+      arrays: [
+        [
+          [
+            {
+              all: [
+                [
+                  {
+                    the: [
+                      'way',
+                      ['down']
+                    ]
+                  }
+                ]
+              ]
+            }
+          ]
+        ]
+      ]
     }
   })
 
@@ -50,7 +70,9 @@ describe('dot():', function () {
       'some.array[0]': 'A',
       'some.array[1]': 'B',
       ehrm: 123,
-      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)')
+      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)'),
+      'arrays[0][0][0].all[0][0].the[0]': 'way',
+      'arrays[0][0][0].all[0][0].the[1][0]': 'down'
     }
 
     Dot.dot(obj).should.eql(expected)
@@ -72,7 +94,8 @@ describe('dot():', function () {
       }],
       'some.array': ['A', 'B'],
       ehrm: 123,
-      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)')
+      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)'),
+      arrays: JSON.parse(JSON.stringify(obj.arrays))
     }
 
     Dot.keepArray = true
@@ -92,10 +115,32 @@ describe('dot():', function () {
       'some.array[0]': 'A',
       'some.array[1]': 'B',
       ehrm: 123,
-      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)')
+      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)'),
+      'arrays[0][0][0].all[0][0].the[0]': 'way',
+      'arrays[0][0][0].all[0][0].the[1][0]': 'down'
+    }
+
+    Dot.dot(obj).should.eql(expected)
+  })
+
+  it('useBrackets wrap indexes without brackets', function () {
+    var expected = {
+      id: 'my-id',
+      'nes.ted.value': true,
+      'other.nested.stuff': 5,
+      'nested.array.0.with': 'object1',
+      'nested.array.1.and': 'object2',
+      'some.array.0': 'A',
+      'some.array.1': 'B',
+      ehrm: 123,
+      'dates.first': new Date('Mon Oct 13 2014 00:00:00 GMT+0100 (BST)'),
+      'arrays.0.0.0.all.0.0.the.0': 'way',
+      'arrays.0.0.0.all.0.0.the.1.0': 'down'
     }
 
+    Dot.useBrackets = false
     Dot.dot(obj).should.eql(expected)
+    Dot.useBrackets = true
   })
 
   it('Always keeps empty arrays', function () {

package/test/str.js

@@ -24,6 +24,28 @@ describe('str:', function () {
     })
   })
 
+  it('can set nested with array notation', function () {
+    var obj = {
+      a: 1
+    }
+    Dot.str('object.fields[0].subfield', 'value', obj)
+    Dot.str('object.fields[1].subfield', 'value1', obj)
+
+    obj.should.deepEqual({
+      a: 1,
+      object: {
+        fields: [
+          {
+            subfield: 'value'
+          },
+          {
+            subfield: 'value1'
+          }
+        ]
+      }
+    })
+  })
+
   it('can set root level property regardless whether override is set', function () {
     Dot.str('a', 'b', {
       a: 1
@@ -31,4 +53,11 @@ describe('str:', function () {
       a: 'b'
     })
   })
+
+  it('cannot set __proto__ property', function () {
+    (() => Dot.str('__proto__.toString', 'hi', {})).should.throw(
+      /Refusing to update/
+    );
+    ({}.toString().should.deepEqual('[object Object]'))
+  })
 })