Control: tag -1 moreinfo
Hi,
JavaScript is not my forte, so I may be up the wrong tree here. But in:
| if (key === '__proto__' &&
| !hasOwnProperty.call(object, '__proto__')) {
| return false;
}
Could it be that `object` here is always the original object, rather than
the object at the current point in the path, allowing a later `__proto__`
to slip through?
Thanks,
--
Jonathan Wiltshire [email protected]
Debian Developer http://people.debian.org/~jmw
4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
