Cleanup

node_modules/mquery/lib/utils.js

@@ -7,6 +7,8 @@
 var Buffer = require('safe-buffer').Buffer;
 var RegExpClone = require('regexp-clone');
 
+var specialProperties = ['__proto__', 'constructor', 'prototype'];
+
 /**
  * Clones objects
  *
@@ -66,9 +68,14 @@ exports.cloneObject = function cloneObject(obj, options) {
   var ret = {};
   var hasKeys;
   var val;
-  var k;
 
-  for (k in obj) {
+  for (const k of Object.keys(obj)) {
+    // Not technically prototype pollution because this wouldn't merge properties
+    // onto `Object.prototype`, but avoid properties like __proto__ as a precaution.
+    if (specialProperties.indexOf(k) !== -1) {
+      continue;
+    }
+
     val = clone(obj[k], options);
 
     if (!minimize || ('undefined' !== typeof val)) {
@@ -133,6 +140,9 @@ exports.merge = function merge(to, from) {
 
   while (i--) {
     key = keys[i];
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     if ('undefined' === typeof to[key]) {
       to[key] = from[key];
     } else {
@@ -160,6 +170,9 @@ exports.mergeClone = function mergeClone(to, from) {
 
   while (i--) {
     key = keys[i];
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     if ('undefined' === typeof to[key]) {
       to[key] = clone(from[key]);
     } else {
@@ -284,13 +297,7 @@ exports.isArray = function(arg) {
  * Object.keys helper
  */
 
-exports.keys = Object.keys || function(obj) {
-  var keys = [];
-  for (var k in obj) if (obj.hasOwnProperty(k)) {
-    keys.push(k);
-  }
-  return keys;
-};
+exports.keys = Object.keys;
 
 /**
  * Basic Object.create polyfill.