fix(security): prototype polution exploit (#217)

JSMike · web-flow · commit a93cf6f47020 · 2022-10-20T22:54:33.000+03:00
diff --git a/lib/parseQuery.js b/lib/parseQuery.js
@@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');

Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ function parseQuery(query) {`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`const queryArgs = query.split(/[,&]/g);`
`29`		`- const result = {};`
	`29`	`+ const result = Object.create(null);`
`30`	`30`
`31`	`31`	`queryArgs.forEach((arg) => {`
`32`	`32`	`const idx = arg.indexOf('=');`