[INTERNAL] lib/jsdoc/ui5/template/publish.js: Avoid prototype polution

JIRA: CPOUI5FOUNDATION-728 This change aligns the code with SAP/ui5-builder#960 Change-Id: Ifa446201155ca579a796ddd57dcb2e0d3834546e
SAP · Nov 24, 2023 · 227731d · 227731d
1 parent d148655
commit 227731d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/jsdoc/ui5/template/publish.js b/lib/jsdoc/ui5/template/publish.js
@@ -89,6 +89,10 @@ function merge(target, source) {
 	if ( source != null ) {
 		// simple single source merge
 		Object.keys(source).forEach((prop) => {
+			// guarding against prototype pollution. (https://codeql.github.com/codeql-query-help/javascript/js-prototype-pollution-utility/#example)
+			if (prop === "__proto__" || prop === "constructor") {
+				return;
+			}
 			const value = source[prop];
 			if ( value != null && value.constructor === Object ) {
 				merge(target[prop] || {}, value);