diff options
| -rw-r--r-- | tests/unit/widget/core.js | 22 | ||||
| -rw-r--r-- | ui/widget.js | 3 |
2 files changed, 25 insertions, 0 deletions
diff --git a/tests/unit/widget/core.js b/tests/unit/widget/core.js index fe74e18e9..38e63a8c0 100644 --- a/tests/unit/widget/core.js +++ b/tests/unit/widget/core.js @@ -242,6 +242,28 @@ QUnit.test( "error handling", function( assert ) { $.error = error; } ); +QUnit.test( "Prototype pollution", function( assert ) { + assert.expect( 3 ); + + var elem = $( "<div>" ); + + $.widget( "ui.testWidget", {} ); + + elem.testWidget(); + + try { + $.widget( "ui.__proto__", {} ); + } catch ( _e ) {} + try { + $.widget( "ui.constructor", {} ); + } catch ( _e ) {} + + assert.strictEqual( Object.getPrototypeOf( $.ui ), Object.prototype, + "$.ui constructor not modified" ); + assert.ok( $.ui instanceof Object, "$.ui is an Object instance" ); + assert.notOk( $.ui instanceof Function, "$.ui is not a Function instance" ); +} ); + QUnit.test( "merge multiple option arguments", function( assert ) { assert.expect( 1 ); $.widget( "ui.testWidget", { diff --git a/ui/widget.js b/ui/widget.js index 7201b4fbf..d5fbd885c 100644 --- a/ui/widget.js +++ b/ui/widget.js @@ -56,6 +56,9 @@ $.widget = function( name, base, prototype ) { var namespace = name.split( "." )[ 0 ]; name = name.split( "." )[ 1 ]; + if ( name === "__proto__" || name === "constructor" ) { + return $.error( "Invalid widget name: " + name ); + } var fullName = namespace + "-" + name; if ( !prototype ) { |