diff options
| -rw-r--r-- | src/core.js | 3 | ||||
| -rw-r--r-- | test/unit/core.js | 7 |
2 files changed, 9 insertions, 1 deletions
diff --git a/src/core.js b/src/core.js index d9c7e9882..3ef92d48f 100644 --- a/src/core.js +++ b/src/core.js @@ -158,8 +158,9 @@ jQuery.extend = jQuery.fn.extend = function() { for ( name in options ) { copy = options[ name ]; + // Prevent Object.prototype pollution // Prevent never-ending loop - if ( target === copy ) { + if ( name === "__proto__" || target === copy ) { continue; } diff --git a/test/unit/core.js b/test/unit/core.js index 8205aa242..28f40ab56 100644 --- a/test/unit/core.js +++ b/test/unit/core.js @@ -1062,6 +1062,13 @@ QUnit.test( "jQuery.extend(true,{},{a:[], o:{}}); deep copy with array, followed assert.ok( !Array.isArray( result.object ), "result.object wasn't paved with an empty array" ); } ); +QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) { + assert.expect( 1 ); + + jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) ); + assert.ok( !( "devMode" in {} ), "Object.prototype not polluted" ); +} ); + QUnit.test( "jQuery.each(Object,Function)", function( assert ) { assert.expect( 23 ); |