_baseUnset.js 1.8 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465
  1. var castPath = require('./_castPath'),
  2. last = require('./last'),
  3. parent = require('./_parent'),
  4. toKey = require('./_toKey');
  5. /** Used for built-in method references. */
  6. var objectProto = Object.prototype;
  7. /** Used to check objects for own properties. */
  8. var hasOwnProperty = objectProto.hasOwnProperty;
  9. /**
  10. * The base implementation of `_.unset`.
  11. *
  12. * @private
  13. * @param {Object} object The object to modify.
  14. * @param {Array|string} path The property path to unset.
  15. * @returns {boolean} Returns `true` if the property is deleted, else `false`.
  16. */
  17. function baseUnset(object, path) {
  18. path = castPath(path, object);
  19. // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
  20. var index = -1,
  21. length = path.length;
  22. if (!length) {
  23. return true;
  24. }
  25. var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
  26. while (++index < length) {
  27. var key = path[index];
  28. // skip non-string keys (e.g., Symbols, numbers)
  29. if (typeof key !== 'string') {
  30. continue;
  31. }
  32. // Always block "__proto__" anywhere in the path if it's not expected
  33. if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
  34. return false;
  35. }
  36. // Block "constructor.prototype" chains
  37. if (key === 'constructor' &&
  38. (index + 1) < length &&
  39. typeof path[index + 1] === 'string' &&
  40. path[index + 1] === 'prototype') {
  41. // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
  42. if (isRootPrimitive && index === 0) {
  43. continue;
  44. }
  45. return false;
  46. }
  47. }
  48. var obj = parent(object, path);
  49. return obj == null || delete obj[toKey(last(path))];
  50. }
  51. module.exports = baseUnset;