From 17cffef1db5007f0ff83e2f4c7f620ef96b21cef Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Wed, 2 Oct 2024 11:33:40 -0700
Subject: [PATCH] fix: prototype pollution vulnerability in extend
 (CVE-2024-45435)

Fixes #1427.
https://nvd.nist.gov/vuln/detail/CVE-2024-45435
https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 src/utils/extend.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/utils/extend.ts b/src/utils/extend.ts
index 99ea3b28..f2779fc6 100644
--- a/src/utils/extend.ts
+++ b/src/utils/extend.ts
@@ -12,6 +12,12 @@ export function extend(target: any = {}, ...sources: any[]) {
   for (let i = 0; i < sources.length; i++) {
     const source = sources[i];
     for (const prop in source) {
+      if (
+        prop in target &&
+        !Object.prototype.hasOwnProperty.call(target, prop)
+      ) {
+        continue; // prevent prototype pollution
+      }
       const sourceProp = source[prop];
       if (
         typeof sourceProp === 'object' &&