From e7a4288838ee0a117ca88dffdb6edec1bf130ebb Mon Sep 17 00:00:00 2001
From: d3v53c <shitfi63@gmail.com>
Date: Mon, 21 Dec 2020 13:06:48 -0800
Subject: [PATCH 1/2] prototype pollution fix

---
 src/path-toolkit.js | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/path-toolkit.js b/src/path-toolkit.js
index 4db1bbb..7447c14 100644
--- a/src/path-toolkit.js
+++ b/src/path-toolkit.js
@@ -63,6 +63,16 @@ var wildCardMatch = function(template, str){
     return match;
 };
 
+/**
+ * Returns true, if given key is included in the blacklisted
+ * keys.
+ * @param {String} key key for check, string.
+ * @returns {Boolean}.
+ */
+function isPrototypePolluted(key) {
+  return ['__proto__', 'prototype', 'constructor'].includes(key);
+}
+
 /**
  * Inspect input value and determine whether it is an Object or not.
  * Values of undefined and null will return "false", otherwise
@@ -1035,7 +1045,10 @@ var PathToolkit = function(options){
                     obj[tk[i]] = {};
                 }
             }
-            obj = obj[tk[i++]];
+            if (!isPrototypePolluted(tk[i])) {
+              obj = obj[tk[i]];
+            }
+            i++;
         }
         return obj;
     };

From df0611a133c417767971b9125cf7960ccf899c4d Mon Sep 17 00:00:00 2001
From: d3v53c <shitfi63@gmail.com>
Date: Fri, 15 Jan 2021 00:34:35 -0800
Subject: [PATCH 2/2] added testcase

---
 test/path-toolkit.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/test/path-toolkit.js b/test/path-toolkit.js
index 5de3f28..a5cd86c 100644
--- a/test/path-toolkit.js
+++ b/test/path-toolkit.js
@@ -667,6 +667,16 @@ describe( 'PathToolkit', function(){
             expect(result).to.be.true;
             expect(ary.join(',')).to.equal('NEW,NEW,NEW');
         });
+
+        it('should prevent prototype pollution', function() {
+          var str = '__proto__.polluted';
+          var obj = {};
+          var result = ptk.set(obj, str, 'Yes, its polluted.');
+          expect(result).to.be.true;
+          expect(obj.polluted).to.be.equal('Yes, its polluted.');
+          expect({}.polluted).to.not.be.equal('Yes, its polluted.');
+          expect({}.polluted).to.be.equal(undefined);
+        })
     });
 
     describe( 'find', function(){