From 442e39c26a2afcea7663f3e28e9f8858ceeeb9a5 Mon Sep 17 00:00:00 2001
From: ezhilkumaran-g_psl <=ezhilkumaran_g@persistent.com>
Date: Mon, 17 Feb 2025 13:12:13 +0530
Subject: [PATCH] Fix for Vulnerability " CVE-2024-57077"

---
 index.js       | 8 ++++++++
 test/extend.js | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/index.js b/index.js
index 5fecaa0..3b94453 100644
--- a/index.js
+++ b/index.js
@@ -28,6 +28,14 @@ function extend(target, source) {
   var value;
 
   for (var key in source) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      continue;
+    }
+
+    if (!Object.prototype.hasOwnProperty.call(source, key)) {
+      continue;
+    }
+
     value = source[key];
 
     if (Array.isArray(value)) {
diff --git a/test/extend.js b/test/extend.js
index cbd8ca5..9470746 100644
--- a/test/extend.js
+++ b/test/extend.js
@@ -51,4 +51,13 @@ describe('extend', function() {
       ]
     });
   });
+
+  it('should not pollute Object.prototype', function() {
+    var target = {};
+    var source = JSON.parse('{"__proto__": {"polluted": "yes"}}');
+
+    util.extend(target, source);
+
+    assert.strictEqual(Object.prototype.polluted, undefined);
+  });
 });
\ No newline at end of file