set-object-value 0.0.6 → 0.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/build/cjs/src/__tests__/IndexTest.js +24 -4
  2. package/build/cjs/src/index.js +23 -17
  3. package/build/es/src/__tests__/IndexTest.js +24 -4
  4. package/build/es/src/index.js +23 -17
  5. package/package.json +9 -10
package/build/cjs/src/__tests__/IndexTest.js CHANGED
@@ -22,23 +22,34 @@ describe("CVE-2020-28281", function () {
22
22
  var obj = {};
23
23
  (0, _chai.expect)(obj.isAdmin).to.be.undefined;
24
24
  (0, _chai.expect)(function () {
25
- return (0, _index["default"])(obj, ['__proto__', 'isAdmin'], true);
25
+ return (0, _index["default"])(obj, ["__proto__", "isAdmin"], true);
26
26
  }).to["throw"]();
27
27
  (0, _chai.expect)(function () {
28
- return (0, _index["default"])(obj, ['constructor', 'isAdmin'], true);
28
+ return (0, _index["default"])(obj, ["constructor", "isAdmin"], true);
29
29
  }).to["throw"]();
30
30
  (0, _chai.expect)(function () {
31
- return (0, _index["default"])(obj, ['prototype', 'isAdmin'], true);
31
+ return (0, _index["default"])(obj, ["prototype", "isAdmin"], true);
32
32
  }).to["throw"]();
33
33
  (0, _chai.expect)(obj.isAdmin).to.be.undefined;
34
+ (0, _chai.expect)({}.isAdmin).to.be.undefined;
34
35
  (0, _index["default"])(obj, ["isAdmin"], true);
35
36
  (0, _chai.expect)(obj.isAdmin).to.be["true"];
36
37
  });
37
38
  it("should force overwrite prototype with unsafe mode", function () {
38
39
  var obj = {};
39
- (0, _index.unsafeSet)(obj, ['__proto__', 'fake'], true);
40
+ (0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
40
41
  (0, _chai.expect)(obj.fake).to.be["true"];
41
42
  });
43
+ it("safe way with unsafe set", function () {
44
+ var obj = Object.create(null);
45
+ (0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
46
+ (0, _chai.expect)(obj.fake).to.be.undefined;
47
+ (0, _chai.expect)(obj.__proto__.fake).to.be["true"];
48
+ var obj2 = Object.create(null);
49
+ (0, _chai.expect)({}.fake).to.be["true"]; // bad case
50
+
51
+ (0, _chai.expect)(obj2.fake).to.be.undefined;
52
+ });
42
53
  });
43
54
  describe("Test append", function () {
44
55
  it("test simple append", function () {
@@ -57,4 +68,13 @@ describe("Test append", function () {
57
68
  a: ["a3", "a4"]
58
69
  });
59
70
  });
71
+ it("last is not array", function () {
72
+ var obj = {
73
+ a: {
74
+ b: "foo"
75
+ }
76
+ };
77
+ (0, _index["default"])(obj, ["a", "b"], "bar", true);
78
+ (0, _chai.expect)(obj.a.b).to.deep.equal(["foo", "bar"]);
79
+ });
60
80
  });
package/build/cjs/src/index.js CHANGED
@@ -5,36 +5,42 @@ Object.defineProperty(exports, "__esModule", {
5
5
  });
6
6
  exports.unsafeSet = exports["default"] = void 0;
7
7
 
8
- var isUnSafeKey = function isUnSafeKey(key) {
9
- return key === "__proto__" || key === "constructor" || key === "prototype";
8
+ var isPrototypePolluted = function isPrototypePolluted(arrPath) {
9
+ var joinPath = "|".concat(arrPath.join("|"), "|");
10
+ return ["__proto__", "constructor", "prototype"].some(function (key) {
11
+ return -1 !== joinPath.indexOf("|".concat(key, "|"));
12
+ });
10
13
  };
11
14
 
12
- var replaceValue = function replaceValue(obj, arrKey, val, isAppend, unSafe) {
13
- if (!unSafe && arrKey.some(isUnSafeKey)) {
15
+ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
16
+ if (!unSafe && isPrototypePolluted(arrPath)) {
14
17
  throw "Contain un-safe key.";
15
18
  }
16
19
 
17
- var last = arrKey.pop();
18
- arrKey.forEach(function (k) {
19
- obj[k] = obj[k] || {};
20
- obj = obj[k];
20
+ var last = arrPath.pop();
21
+ var linkObj = obj;
22
+ arrPath.forEach(function (k) {
23
+ var _linkObj$k;
24
+
25
+ linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
26
+ linkObj = linkObj[k];
21
27
  });
22
28
 
23
- if (isAppend && (!obj[last] || !obj[last].push)) {
24
- if (!obj[last]) {
25
- obj[last] = [val];
29
+ if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
30
+ if (!linkObj[last]) {
31
+ linkObj[last] = [val];
26
32
  } else {
27
- obj[last] = [obj[last], val];
33
+ linkObj[last] = [linkObj[last], val];
28
34
  }
29
- } else if (isAppend && obj[last].push) {
30
- obj[last].push(val);
35
+ } else if (isAppend && linkObj[last].push) {
36
+ linkObj[last].push(val);
31
37
  } else {
32
- obj[last] = val;
38
+ linkObj[last] = val;
33
39
  }
34
40
  };
35
41
 
36
- var unsafeSet = function unsafeSet(obj, arrKey, val, isAppend) {
37
- return replaceValue(obj, arrKey, val, isAppend, true);
42
+ var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
43
+ return replaceValue(obj, arrPath, val, isAppend, true);
38
44
  };
39
45
 
40
46
  exports.unsafeSet = unsafeSet;
package/build/es/src/__tests__/IndexTest.js CHANGED
@@ -16,23 +16,34 @@ describe("CVE-2020-28281", function () {
16
16
  var obj = {};
17
17
  expect(obj.isAdmin).to.be.undefined;
18
18
  expect(function () {
19
- return set(obj, ['__proto__', 'isAdmin'], true);
19
+ return set(obj, ["__proto__", "isAdmin"], true);
20
20
  }).to["throw"]();
21
21
  expect(function () {
22
- return set(obj, ['constructor', 'isAdmin'], true);
22
+ return set(obj, ["constructor", "isAdmin"], true);
23
23
  }).to["throw"]();
24
24
  expect(function () {
25
- return set(obj, ['prototype', 'isAdmin'], true);
25
+ return set(obj, ["prototype", "isAdmin"], true);
26
26
  }).to["throw"]();
27
27
  expect(obj.isAdmin).to.be.undefined;
28
+ expect({}.isAdmin).to.be.undefined;
28
29
  set(obj, ["isAdmin"], true);
29
30
  expect(obj.isAdmin).to.be["true"];
30
31
  });
31
32
  it("should force overwrite prototype with unsafe mode", function () {
32
33
  var obj = {};
33
- unsafeSet(obj, ['__proto__', 'fake'], true);
34
+ unsafeSet(obj, ["__proto__", "fake"], true);
34
35
  expect(obj.fake).to.be["true"];
35
36
  });
37
+ it("safe way with unsafe set", function () {
38
+ var obj = Object.create(null);
39
+ unsafeSet(obj, ["__proto__", "fake"], true);
40
+ expect(obj.fake).to.be.undefined;
41
+ expect(obj.__proto__.fake).to.be["true"];
42
+ var obj2 = Object.create(null);
43
+ expect({}.fake).to.be["true"]; // bad case
44
+
45
+ expect(obj2.fake).to.be.undefined;
46
+ });
36
47
  });
37
48
  describe("Test append", function () {
38
49
  it("test simple append", function () {
@@ -51,4 +62,13 @@ describe("Test append", function () {
51
62
  a: ["a3", "a4"]
52
63
  });
53
64
  });
65
+ it("last is not array", function () {
66
+ var obj = {
67
+ a: {
68
+ b: "foo"
69
+ }
70
+ };
71
+ set(obj, ["a", "b"], "bar", true);
72
+ expect(obj.a.b).to.deep.equal(["foo", "bar"]);
73
+ });
54
74
  });
package/build/es/src/index.js CHANGED
@@ -1,33 +1,39 @@
1
- var isUnSafeKey = function isUnSafeKey(key) {
2
- return key === "__proto__" || key === "constructor" || key === "prototype";
1
+ var isPrototypePolluted = function isPrototypePolluted(arrPath) {
2
+ var joinPath = "|".concat(arrPath.join("|"), "|");
3
+ return ["__proto__", "constructor", "prototype"].some(function (key) {
4
+ return -1 !== joinPath.indexOf("|".concat(key, "|"));
5
+ });
3
6
  };
4
7
 
5
- var replaceValue = function replaceValue(obj, arrKey, val, isAppend, unSafe) {
6
- if (!unSafe && arrKey.some(isUnSafeKey)) {
8
+ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
9
+ if (!unSafe && isPrototypePolluted(arrPath)) {
7
10
  throw "Contain un-safe key.";
8
11
  }
9
12
 
10
- var last = arrKey.pop();
11
- arrKey.forEach(function (k) {
12
- obj[k] = obj[k] || {};
13
- obj = obj[k];
13
+ var last = arrPath.pop();
14
+ var linkObj = obj;
15
+ arrPath.forEach(function (k) {
16
+ var _linkObj$k;
17
+
18
+ linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
19
+ linkObj = linkObj[k];
14
20
  });
15
21
 
16
- if (isAppend && (!obj[last] || !obj[last].push)) {
17
- if (!obj[last]) {
18
- obj[last] = [val];
22
+ if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
23
+ if (!linkObj[last]) {
24
+ linkObj[last] = [val];
19
25
  } else {
20
- obj[last] = [obj[last], val];
26
+ linkObj[last] = [linkObj[last], val];
21
27
  }
22
- } else if (isAppend && obj[last].push) {
23
- obj[last].push(val);
28
+ } else if (isAppend && linkObj[last].push) {
29
+ linkObj[last].push(val);
24
30
  } else {
25
- obj[last] = val;
31
+ linkObj[last] = val;
26
32
  }
27
33
  };
28
34
 
29
- var unsafeSet = function unsafeSet(obj, arrKey, val, isAppend) {
30
- return replaceValue(obj, arrKey, val, isAppend, true);
35
+ var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
36
+ return replaceValue(obj, arrPath, val, isAppend, true);
31
37
  };
32
38
 
33
39
  export default replaceValue;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "set-object-value",
3
- "version": "0.0.6",
3
+ "version": "0.0.8",
4
4
  "description": "set object nested value",
5
5
  "repository": "react-atomic/react-atomic-organism",
6
6
  "main": "./build/cjs/src/index.js",
@@ -15,15 +15,14 @@
15
15
  "mocha": "*"
16
16
  },
17
17
  "scripts": {
18
- "build:cjs": "BABEL_ENV=build babel src -d build/cjs/src --root-mode upward",
18
+ "clean": "find ./build -name '*.*' | xargs rm -rf",
19
+ "build": "npm run clean && npm run build:cjs && npm run build:es",
20
+ "build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --root-mode upward",
19
21
  "build:es": "BABEL_ENV=es babel src -d build/es/src --root-mode upward",
20
- "build": "rm -rf build && npm run build:cjs && npm run build:es",
21
- "prepublishOnly": "npm run test && npm run build",
22
- "test": "npm run build && mocha 'build/cjs/**/__tests__/*.js'"
22
+ "mochaFor": "mocha",
23
+ "mocha": "npm run mochaFor -- 'build/cjs/**/__tests__/*.js'",
24
+ "test": "npm run build && npm run mocha",
25
+ "prepublishOnly": "npm run test"
23
26
  },
24
- "files": [
25
- "build",
26
- "package.json",
27
- "README.md"
28
- ]
27
+ "files": ["build", "package.json", "README.md"]
29
28
  }