e8cc578efcada1b0210acc11e5449e29eaad4d32 Fix: A malicious plug-in for…

… the DataTables API could potentially attempt to add to an object's prototype. Sync to source repo @e8cc578efcada1b0210acc11e5449e29eaad4d32
DataTables · Apr 9, 2024 · 9ea1b00 · 9ea1b00
1 parent 6172084
commit 9ea1b00
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 3 deletions.
diff --git a/datatables.json b/datatables.json
@@ -11,5 +11,5 @@
     ],
     "src-repo": "http://github.com/DataTables/DataTablesSrc",
     "last-tag": "2.0.3",
-    "last-sync": "ded438d92e3b54bc95c1a2dabbaf55e372dee4bf"
+    "last-sync": "e8cc578efcada1b0210acc11e5449e29eaad4d32"
 }
diff --git a/js/dataTables.js b/js/dataTables.js
@@ -6858,6 +6858,10 @@
 		for ( i=0, ien=ext.length ; i<ien ; i++ ) {
 			struct = ext[i];
 
+			if (struct.name === '__proto__') {
+				continue;
+			}
+
 			// Value
 			obj[ struct.name ] = struct.type === 'function' ?
 				_api_scope( scope, struct.val, struct ) :

diff --git a/js/dataTables.min.js b/js/dataTables.min.js
diff --git a/js/dataTables.min.mjs b/js/dataTables.min.mjs
diff --git a/js/dataTables.mjs b/js/dataTables.mjs
@@ -6805,6 +6805,10 @@ _Api.extend = function ( scope, obj, ext )
 	for ( i=0, ien=ext.length ; i<ien ; i++ ) {
 		struct = ext[i];
 
+		if (struct.name === '__proto__') {
+			continue;
+		}
+
 		// Value
 		obj[ struct.name ] = struct.type === 'function' ?
 			_api_scope( scope, struct.val, struct ) :