Use Object.create(null) as `merge` target (#7920)

diff --git a/src/core/core.controller.js b/src/core/core.controller.js
index 98cffef2673dbfb5d08feaba328d7a4356b03332..194c5aa500410b52344a01fb49b5fe02e215ccfb 100644 (file)
--- a/src/core/core.controller.js
+++ b/src/core/core.controller.js
@@ -41,7 +41,7 @@ defaults._set('global', {
  * returns a deep copy of the result, thus doesn't alter inputs.
  */
 function mergeScaleConfig(/* config objects ... */) {
-       return helpers.merge({}, [].slice.call(arguments), {
+       return helpers.merge(Object.create(null), [].slice.call(arguments), {
                merger: function(key, target, source, options) {
                        if (key === 'xAxes' || key === 'yAxes') {
                                var slen = source[key].length;
@@ -81,9 +81,9 @@ function mergeScaleConfig(/* config objects ... */) {
  * a deep copy of the result, thus doesn't alter inputs.
  */
 function mergeConfig(/* config objects ... */) {
-       return helpers.merge({}, [].slice.call(arguments), {
+       return helpers.merge(Object.create(null), [].slice.call(arguments), {
                merger: function(key, target, source, options) {
-                       var tval = target[key] || {};
+                       var tval = target[key] || Object.create(null);
                        var sval = source[key];
 
                        if (key === 'scales') {
@@ -100,7 +100,7 @@ function mergeConfig(/* config objects ... */) {
 }
 
 function initConfig(config) {
-       config = config || {};
+       config = config || Object.create(null);
 
        // Do NOT use mergeConfig for the data object because this method merges arrays
        // and so would change references to labels and datasets, preventing data updates.

diff --git a/src/core/core.datasetController.js b/src/core/core.datasetController.js
index d17c7be0029d568f3265f8c574be38749d37ee7c..87e18aebe10bc62370bb92468b055ad33db4bb3c 100644 (file)
--- a/src/core/core.datasetController.js
+++ b/src/core/core.datasetController.js
@@ -275,7 +275,7 @@ helpers.extend(DatasetController.prototype, {
         */
        _configure: function() {
                var me = this;
-               me._config = helpers.merge({}, [
+               me._config = helpers.merge(Object.create(null), [
                        me.chart.options.datasets[me._type],
                        me.getDataset(),
                ], {

diff --git a/src/core/core.scaleService.js b/src/core/core.scaleService.js
index fe94538200318e685c9de8019699f9af1bcbb6a7..31ab1d63c98bd552d4cc2ad6a8376da996b831fb 100644 (file)
--- a/src/core/core.scaleService.js
+++ b/src/core/core.scaleService.js
@@ -22,7 +22,7 @@ module.exports = {
        },
        getScaleDefaults: function(type) {
                // Return the scale defaults merged with the global settings so that we always use the latest ones
-               return this.defaults.hasOwnProperty(type) ? helpers.merge({}, [defaults.scale, this.defaults[type]]) : {};
+               return this.defaults.hasOwnProperty(type) ? helpers.merge(Object.create(null), [defaults.scale, this.defaults[type]]) : {};
        },
        updateScaleDefaults: function(type, additions) {
                var me = this;

diff --git a/test/specs/helpers.core.tests.js b/test/specs/helpers.core.tests.js
index d145bb21d0e8a05badf5dbf36a71ba7e4aa15e11..a6325736d789d9441932cf2c38078392b81446eb 100644 (file)
--- a/test/specs/helpers.core.tests.js
+++ b/test/specs/helpers.core.tests.js
@@ -265,6 +265,11 @@ describe('Chart.helpers.core', function() {
        });
 
        describe('clone', function() {
+               it('should not allow prototype pollution', function() {
+                       var test = helpers.clone(JSON.parse('{"__proto__":{"polluted": true}}'));
+                       expect(test.prototype).toBeUndefined();
+                       expect(Object.prototype.polluted).toBeUndefined();
+               });
                it('should clone primitive values', function() {
                        expect(helpers.clone()).toBe(undefined);
                        expect(helpers.clone(null)).toBe(null);