Merge pull request #17 from jonschlinkert/key-properties

Property keys

Author: doowb

.travis.yml

@@ -17,4 +17,5 @@ node_js:
 matrix:
  fast_finish: true
  allow_failures:
+ - node_js: 'node'
  - node_js: '0.8'

index.js

@@ -32,7 +32,7 @@ module.exports = function mergeDeep(orig, objects) {
 
 function merge(target, obj) {
  for (var key in obj) {
- if (key === '__proto__' || !hasOwn(obj, key)) {
+ if (!isValidKey(key) || !hasOwn(obj, key)) {
  continue;
  }
 
@@ -57,3 +57,7 @@ function hasOwn(obj, key) {
 function isObject(val) {
  return typeOf(val) === 'object' || typeOf(val) === 'function';
 }
+
+function isValidKey(key) {
+ return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
+}

test.js

@@ -134,4 +134,68 @@ describe('mergeDeep', function() {
  var actual = merge(fixture);
  assert.deepEqual(actual, fixture);
  });
+
+ it('should not clone invalid keys', function() {
+ var obj1 = { a: { b: 1 } };
+ var obj2 = JSON.parse('{ "a": { "c": 2 }, "constructor": { "keys": 42 } }');
+
+ var actual = merge({}, obj1, obj2);
+ assert.deepEqual(actual, { a: { b: 1, c: 2 } });
+ assert.notDeepEqual(actual.a, obj1.a);
+ assert.notDeepEqual(actual.a, obj2.a);
+ assert.notEqual(actual.keys, 42);
+ assert.notEqual(actual.constructor.keys, 42);
+ });
+
+ it('should allow being used for custom constructors', function() {
+ // The following setup code is a simple way to demonstrate multiple inheritance by merging the prototype of one class onto another
+ function Shape() {
+ this.type = '';
+ }
+
+ function Position(x, y) {
+ this.x = x || 0;
+ this.y = y || 0;
+ }
+
+ Position.prototype.stringify = function() {
+ return '(' + this.x + ', ' + this.y + ')';
+ };
+
+ function Moveable(x, y) {
+ Position.call(this, x, y);
+ }
+
+ // By making Moveable inherit from Position, allows us to test what happens when `constructor` is passed to `isValidKey`.
+ Moveable.prototype = Object.create(Position.prototype);
+ Moveable.prototype.constructor = Moveable;
+ Moveable.prototype = merge(Moveable.prototype, Position.prototype);
+
+ Moveable.prototype.move = function(x, y) {
+ this.x += x;
+ this.y += y;
+ };
+
+ Moveable.prototype.position = function() {
+ return this.stringify();
+ };
+
+ function Rectangle() {
+ Shape.call(this);
+ Moveable.call(this);
+ this.type = 'rectangle';
+ }
+
+ // Single inheritance using Object.create
+ Rectangle.prototype = Object.create(Shape.prototype);
+ Rectangle.prototype.constructor = Rectangle;
+
+ // This is the test to ensure that `merge-deep` can be used with prototypal inheritance
+ Rectangle.prototype = merge(Rectangle.prototype, Moveable.prototype);
+
+ var rectangle = new Rectangle();
+ assert.equal(rectangle.position(), '(0, 0)');
+ rectangle.move(10, 20);
+ assert.equal(rectangle.position(), '(10, 20)');
+ });
 });