diff --git a/src/utils/extend.ts b/src/utils/extend.ts index 99ea3b28..77f4b4a6 100644 --- a/src/utils/extend.ts +++ b/src/utils/extend.ts @@ -11,7 +11,11 @@ export function extend(target: T, a: A, b: B): T & A & B; export function extend(target: any = {}, ...sources: any[]) { for (let i = 0; i < sources.length; i++) { const source = sources[i]; + const targetProto = Object.getPrototypeOf(target); for (const prop in source) { + if (targetProto !== null && prop in targetProto) { + continue; // prevent prototype pollution + } const sourceProp = source[prop]; if ( typeof sourceProp === 'object' &&