diff --git a/lib/nconf/stores/memory.js b/lib/nconf/stores/memory.js index 6220438c..dead79b1 100644 --- a/lib/nconf/stores/memory.js +++ b/lib/nconf/stores/memory.js @@ -92,7 +92,7 @@ Memory.prototype.set = function (key, value) { // while (path.length > 1) { key = path.shift(); - if (!target[key] || typeof target[key] !== 'object') { + if (!target[key] || typeof target[key] !== 'object' || !Object.hasOwnProperty.call(target, key)) { target[key] = {}; } diff --git a/test/stores/memory-store-test.js b/test/stores/memory-store-test.js index 76489cac..0f8c6fa6 100644 --- a/test/stores/memory-store-test.js +++ b/test/stores/memory-store-test.js @@ -121,5 +121,12 @@ vows.describe('nconf/stores/memory').addBatch({ assert.equal(store.get('foo').bar.bazz, 'buzz'); } } + }, + "When attempting prototype pollution": { + topic: new nconf.Memory(), + "should not be able to pollute the prototype": function (store) { + store.set('__proto__:polluted', 'yes'); + assert.equal({}.polluted, undefined); + } } }).export(module);