fix: prototype pollution vulnerability

khalby786 · Mar 12, 2021 · 8d17ef7 · 8d17ef7
1 parent f15abc9
commit 8d17ef7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jsoning",
-  "version": "0.8.18",
+  "version": "0.9.18",
   "description": "A simple key-value JSON-based persistent lightweight database.",
   "main": "src/index.js",
   "scripts": {

diff --git a/src/jsoning.js b/src/jsoning.js
@@ -126,7 +126,7 @@ class Jsoning {
     let db = JSON.parse(
       fs.readFileSync(resolve(__dirname, this.database), "utf-8")
     );
-    if (db.hasOwnProperty(key)) {
+    if (Object.prototype.hasOwnProperty.call(db, key)) {
       try {
         const removeProp = key;
         const { [removeProp]: remove, ...rest } = db;
@@ -165,7 +165,7 @@ class Jsoning {
 
     let db = fs.readFileSync(resolve(__dirname, this.database), "utf-8");
     db = JSON.parse(db);
-    if (db[key]) {
+    if (Object.prototype.hasOwnProperty.call(db, key)) {
       let data = db[key];
       return data;
     } else {
@@ -245,7 +245,7 @@ class Jsoning {
     let db = JSON.parse(
       fs.readFileSync(resolve(__dirname, this.database), "utf-8")
     );
-    if (db[key]) {
+    if (Object.prototype.hasOwnProperty.call(db, key)) {
       // key exists
       let value = db[key];
       if (typeof value !== "number" || value === "") {
@@ -318,7 +318,7 @@ class Jsoning {
     let db = fs.readFileSync(resolve(__dirname, this.database), "utf-8");
     db = JSON.parse(db);
 
-    if (db.hasOwnProperty(key)) {
+    if (Object.prototype.hasOwnProperty.call(db, key)) {
       return true;
     } else {
       return false;
@@ -344,7 +344,7 @@ class Jsoning {
     let db = fs.readFileSync(resolve(__dirname, this.database), "utf-8");
     db = JSON.parse(db);
 
-    if (db.hasOwnProperty(key)) {
+    if (Object.prototype.hasOwnProperty.call(db, key)) {
       if (!Array.isArray(db[key])) {
         console.log(db);
         console.log(typeof db[key]);