_baseUnset.js 1.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152
  1. import castPath from './_castPath.js';
  2. import last from './last.js';
  3. import parent from './_parent.js';
  4. import toKey from './_toKey.js';
  5. /** Used for built-in method references. */
  6. var objectProto = Object.prototype;
  7. /** Used to check objects for own properties. */
  8. var hasOwnProperty = objectProto.hasOwnProperty;
  9. /**
  10. * The base implementation of `_.unset`.
  11. *
  12. * @private
  13. * @param {Object} object The object to modify.
  14. * @param {Array|string} path The property path to unset.
  15. * @returns {boolean} Returns `true` if the property is deleted, else `false`.
  16. */
  17. function baseUnset(object, path) {
  18. path = castPath(path, object);
  19. // Prevent prototype pollution:
  20. // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
  21. // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
  22. var index = -1,
  23. length = path.length;
  24. if (!length) {
  25. return true;
  26. }
  27. while (++index < length) {
  28. var key = toKey(path[index]);
  29. // Always block "__proto__" anywhere in the path if it's not expected
  30. if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
  31. return false;
  32. }
  33. // Block constructor/prototype as non-terminal traversal keys to prevent
  34. // escaping the object graph into built-in constructors and prototypes.
  35. if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
  36. return false;
  37. }
  38. }
  39. var obj = parent(object, path);
  40. return obj == null || delete obj[toKey(last(path))];
  41. }
  42. export default baseUnset;