yargs 13.3.0 → 13.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +2 -2
  2. package/yargs.js +10 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "yargs",
3
- "version": "13.3.0",
3
+ "version": "13.3.2",
4
4
  "description": "yargs the modern, pirate-themed, successor to optimist.",
5
5
  "main": "./index.js",
6
6
  "contributors": [
@@ -28,7 +28,7 @@
28
28
  "string-width": "^3.0.0",
29
29
  "which-module": "^2.0.0",
30
30
  "y18n": "^4.0.0",
31
- "yargs-parser": "^13.1.1"
31
+ "yargs-parser": "^13.1.2"
32
32
  },
33
33
  "devDependencies": {
34
34
  "chai": "^4.2.0",
package/yargs.js CHANGED
@@ -231,6 +231,7 @@ function Yargs (processArgs, cwd, parentRequire) {
231
231
  function populateParserHintArray (type, keys, value) {
232
232
  keys = [].concat(keys)
233
233
  keys.forEach((key) => {
234
+ key = sanitizeKey(key)
234
235
  options[type].push(key)
235
236
  })
236
237
  }
@@ -286,8 +287,8 @@ function Yargs (processArgs, cwd, parentRequire) {
286
287
 
287
288
  function populateParserHintObject (builder, isArray, type, key, value) {
288
289
  if (Array.isArray(key)) {
290
+ const temp = Object.create(null)
289
291
  // an array of keys with one value ['x', 'y', 'z'], function parse () {}
290
- const temp = {}
291
292
  key.forEach((k) => {
292
293
  temp[k] = value
293
294
  })
@@ -298,6 +299,7 @@ function Yargs (processArgs, cwd, parentRequire) {
298
299
  builder(k, key[k])
299
300
  })
300
301
  } else {
302
+ key = sanitizeKey(key)
301
303
  // a single key value pair 'x', parse() {}
302
304
  if (isArray) {
303
305
  options[type][key] = (options[type][key] || []).concat(value)
@@ -307,6 +309,13 @@ function Yargs (processArgs, cwd, parentRequire) {
307
309
  }
308
310
  }
309
311
 
312
+ // TODO(bcoe): in future major versions move more objects towards
313
+ // Object.create(null):
314
+ function sanitizeKey (key) {
315
+ if (key === '__proto__') return '___proto___'
316
+ return key
317
+ }
318
+
310
319
  function deleteFromParserHintObject (optionKey) {
311
320
  // delete from all parsing hints:
312
321
  // boolean, array, key, alias, etc.