From e66379f451b0393c27d87b37fa7d271619e16b0d Mon Sep 17 00:00:00 2001
From: Alexander Fenster <fenster@google.com>
Date: Fri, 23 Jun 2023 15:46:03 -0700
Subject: [PATCH] fix: do not let setProperty change the prototype (#1899)

* fix: do not let setProperty change the prototype

* test: add unit test
---
 src/util.js       | 2 +-
 tests/api_util.js | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/util.js b/src/util.js
index c39d33a6a..6c508990b 100644
--- a/src/util.js
+++ b/src/util.js
@@ -176,7 +176,7 @@ util.decorateEnum = function decorateEnum(object) {
 util.setProperty = function setProperty(dst, path, value) {
     function setProp(dst, path, value) {
         var part = path.shift();
-        if (part === "__proto__") {
+        if (part === "__proto__" || part === "prototype") {
           return dst;
         }
         if (path.length > 0) {
diff --git a/tests/api_util.js b/tests/api_util.js
index 7b6f50ffe..63da0170f 100644
--- a/tests/api_util.js
+++ b/tests/api_util.js
@@ -95,6 +95,15 @@ tape.test("util", function(test) {
 
         util.setProperty(o, 'prop.subprop', { subsub2: 7});
         test.same(o, {prop1: [5, 6], prop: {subprop: [{subsub: [5,6]}, {subsub2: 7}]}}, "should convert nested properties to array");
+        
+        util.setProperty({}, "__proto__.test", "value");
+        test.is({}.test, undefined);
+
+        util.setProperty({}, "prototype.test", "value");
+        test.is({}.test, undefined);
+
+        util.setProperty({}, "constructor.prototype.test", "value");
+        test.is({}.test, undefined);
 
         test.end();
     });