yargs 14.2.2 → 14.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +2 -2
  2. package/yargs.js +10 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "yargs",
3
- "version": "14.2.2",
3
+ "version": "14.2.3",
4
4
  "description": "yargs the modern, pirate-themed, successor to optimist.",
5
5
  "main": "./index.js",
6
6
  "contributors": [
@@ -29,7 +29,7 @@
29
29
  "string-width": "^3.0.0",
30
30
  "which-module": "^2.0.0",
31
31
  "y18n": "^4.0.0",
32
- "yargs-parser": "^15.0.0"
32
+ "yargs-parser": "^15.0.1"
33
33
  },
34
34
  "devDependencies": {
35
35
  "chai": "^4.2.0",
package/yargs.js CHANGED
@@ -238,6 +238,7 @@ function Yargs (processArgs, cwd, parentRequire) {
238
238
  function populateParserHintArray (type, keys, value) {
239
239
  keys = [].concat(keys)
240
240
  keys.forEach((key) => {
241
+ key = sanitizeKey(key)
241
242
  options[type].push(key)
242
243
  })
243
244
  }
@@ -293,8 +294,8 @@ function Yargs (processArgs, cwd, parentRequire) {
293
294
 
294
295
  function populateParserHintObject (builder, isArray, type, key, value) {
295
296
  if (Array.isArray(key)) {
297
+ const temp = Object.create(null)
296
298
  // an array of keys with one value ['x', 'y', 'z'], function parse () {}
297
- const temp = {}
298
299
  key.forEach((k) => {
299
300
  temp[k] = value
300
301
  })
@@ -305,6 +306,7 @@ function Yargs (processArgs, cwd, parentRequire) {
305
306
  builder(k, key[k])
306
307
  })
307
308
  } else {
309
+ key = sanitizeKey(key)
308
310
  // a single key value pair 'x', parse() {}
309
311
  if (isArray) {
310
312
  options[type][key] = (options[type][key] || []).concat(value)
@@ -314,6 +316,13 @@ function Yargs (processArgs, cwd, parentRequire) {
314
316
  }
315
317
  }
316
318
 
319
+ // TODO(bcoe): in future major versions move more objects towards
320
+ // Object.create(null):
321
+ function sanitizeKey (key) {
322
+ if (key === '__proto__') return '___proto___'
323
+ return key
324
+ }
325
+
317
326
  function deleteFromParserHintObject (optionKey) {
318
327
  // delete from all parsing hints:
319
328
  // boolean, array, key, alias, etc.