| 1 | var castPath = require('./_castPath'),
|
|---|
| 2 | last = require('./last'),
|
|---|
| 3 | parent = require('./_parent'),
|
|---|
| 4 | toKey = require('./_toKey');
|
|---|
| 5 |
|
|---|
| 6 | /** Used for built-in method references. */
|
|---|
| 7 | var objectProto = Object.prototype;
|
|---|
| 8 |
|
|---|
| 9 | /** Used to check objects for own properties. */
|
|---|
| 10 | var hasOwnProperty = objectProto.hasOwnProperty;
|
|---|
| 11 |
|
|---|
| 12 | /**
|
|---|
| 13 | * The base implementation of `_.unset`.
|
|---|
| 14 | *
|
|---|
| 15 | * @private
|
|---|
| 16 | * @param {Object} object The object to modify.
|
|---|
| 17 | * @param {Array|string} path The property path to unset.
|
|---|
| 18 | * @returns {boolean} Returns `true` if the property is deleted, else `false`.
|
|---|
| 19 | */
|
|---|
| 20 | function baseUnset(object, path) {
|
|---|
| 21 | path = castPath(path, object);
|
|---|
| 22 |
|
|---|
| 23 | // Prevent prototype pollution:
|
|---|
| 24 | // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
|
|---|
| 25 | // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
|
|---|
| 26 | var index = -1,
|
|---|
| 27 | length = path.length;
|
|---|
| 28 |
|
|---|
| 29 | if (!length) {
|
|---|
| 30 | return true;
|
|---|
| 31 | }
|
|---|
| 32 |
|
|---|
| 33 | while (++index < length) {
|
|---|
| 34 | var key = toKey(path[index]);
|
|---|
| 35 |
|
|---|
| 36 | // Always block "__proto__" anywhere in the path if it's not expected
|
|---|
| 37 | if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
|
|---|
| 38 | return false;
|
|---|
| 39 | }
|
|---|
| 40 |
|
|---|
| 41 | // Block constructor/prototype as non-terminal traversal keys to prevent
|
|---|
| 42 | // escaping the object graph into built-in constructors and prototypes.
|
|---|
| 43 | if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
|
|---|
| 44 | return false;
|
|---|
| 45 | }
|
|---|
| 46 | }
|
|---|
| 47 |
|
|---|
| 48 | var obj = parent(object, path);
|
|---|
| 49 | return obj == null || delete obj[toKey(last(path))];
|
|---|
| 50 | }
|
|---|
| 51 |
|
|---|
| 52 | module.exports = baseUnset;
|
|---|