New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix array coercion with empty string, protect from prototype poisoning #111

Merged

devinivy merged 1 commit into master from fix-empty-split-json-proto-v5

Mar 25, 2021

Member

devinivy commented Mar 24, 2021

Pulling some fixes out of #110 to ensure they land in v5:

Array coercion from string incorrectly interpreted '' into [''] rather than [].
JSON parsing during object coercion protects from prototype poisoning using bourne.


          Fix array coercion with empty string, protect from prototype poisoning

devinivy added bug security labels

devinivy added this to the 5.0.1 milestone

devinivy self-assigned this

devinivy merged commit 7934246 into master

devinivy deleted the fix-empty-split-json-proto-v5 branch

March 25, 2021 02:59

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels