diff --git a/build/js-transpiled/node_modules/ini/ini.js b/build/js-transpiled/node_modules/ini/ini.js index 590195dd..04012588 100644 --- a/build/js-transpiled/node_modules/ini/ini.js +++ b/build/js-transpiled/node_modules/ini/ini.js @@ -80,6 +80,12 @@ function decode (str) { if (!match) return if (match[1] !== undefined) { section = unsafe(match[1]) + if (section === '__proto__') { + // not allowed + // keep parsing the section, but don't attach it. + p = {} + return + } p = out[section] = out[section] || {} return } @@ -94,6 +100,7 @@ function decode (str) { // Convert keys with '[]' suffix to an array if (key.length > 2 && key.slice(-2) === '[]') { key = key.substring(0, key.length - 2) + if (key === '__proto__') return if (!p[key]) { p[key] = [] } else if (!Array.isArray(p[key])) { @@ -125,6 +132,7 @@ function decode (str) { var l = parts.pop() var nl = l.replace(/\\\./g, '.') parts.forEach(function (part, _, __) { + if (part === '__proto__') return if (!p[part] || typeof p[part] !== 'object') p[part] = {} p = p[part] })