floppy-disk 3.6.0 → 3.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/vanilla.mjs +7 -1
- package/package.json +3 -2
- package/vanilla.js +7 -1
package/esm/vanilla.mjs
CHANGED
|
@@ -62,7 +62,13 @@ const initStore = (initialState, options = {}) => {
|
|
|
62
62
|
const prevState = state;
|
|
63
63
|
const newValue = getValue(value, state);
|
|
64
64
|
const changedKeys = [];
|
|
65
|
-
for (const key
|
|
65
|
+
for (const key of Object.keys(newValue)) {
|
|
66
|
+
if (key === "__proto__" || key === "constructor" || key === "prototype") {
|
|
67
|
+
console.warn(
|
|
68
|
+
`Ignored unsafe key "${String(key)}" in setState(). This key is reserved and may indicate a prototype pollution attempt or malformed payload.`
|
|
69
|
+
);
|
|
70
|
+
continue;
|
|
71
|
+
}
|
|
66
72
|
if (!Object.is(prevState[key], newValue[key])) {
|
|
67
73
|
changedKeys.push(key);
|
|
68
74
|
}
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "floppy-disk",
|
|
3
3
|
"description": "Lightweight unified state management for sync and async data.",
|
|
4
4
|
"private": false,
|
|
5
|
-
"version": "3.6.
|
|
5
|
+
"version": "3.6.1",
|
|
6
6
|
"keywords": [
|
|
7
7
|
"utilities",
|
|
8
8
|
"store",
|
|
@@ -68,6 +68,7 @@
|
|
|
68
68
|
}
|
|
69
69
|
}
|
|
70
70
|
},
|
|
71
|
+
"packageManager": "pnpm@10.32.1",
|
|
71
72
|
"peerDependencies": {
|
|
72
73
|
"@types/react": ">=17.0",
|
|
73
74
|
"react": ">=17.0"
|
|
@@ -80,4 +81,4 @@
|
|
|
80
81
|
"optional": true
|
|
81
82
|
}
|
|
82
83
|
}
|
|
83
|
-
}
|
|
84
|
+
}
|
package/vanilla.js
CHANGED
|
@@ -64,7 +64,13 @@ const initStore = (initialState, options = {}) => {
|
|
|
64
64
|
const prevState = state;
|
|
65
65
|
const newValue = getValue(value, state);
|
|
66
66
|
const changedKeys = [];
|
|
67
|
-
for (const key
|
|
67
|
+
for (const key of Object.keys(newValue)) {
|
|
68
|
+
if (key === "__proto__" || key === "constructor" || key === "prototype") {
|
|
69
|
+
console.warn(
|
|
70
|
+
`Ignored unsafe key "${String(key)}" in setState(). This key is reserved and may indicate a prototype pollution attempt or malformed payload.`
|
|
71
|
+
);
|
|
72
|
+
continue;
|
|
73
|
+
}
|
|
68
74
|
if (!Object.is(prevState[key], newValue[key])) {
|
|
69
75
|
changedKeys.push(key);
|
|
70
76
|
}
|