We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 2da4cc5 commit 1337108Copy full SHA for 1337108
index.js
@@ -44,17 +44,14 @@ module.exports = function (bodyParser) {
44
}
45
46
// Prevent setting __proto__ and constructor.prototype
47
- const safe = {};
48
- for (const key in xml) {
49
- if (
50
- key !== '__proto__' &&
51
- key !== 'constructor' &&
52
- key !== 'prototype'
53
- ) {
54
- safe[key] = xml[key];
55
- }
+ if(xml) {
+ // Guard against prototype pollution
+ delete xml.__proto__;
+ delete xml.constructor;
+ delete xml.prototype;
+
+ req.body = xml;
56
57
- req.body = safe || req.body;
58
next();
59
});
60
0 commit comments