diff --git a/packages/util/src/object/spread.ts b/packages/util/src/object/spread.ts index 2d08c00212..fc9370ef98 100644 --- a/packages/util/src/object/spread.ts +++ b/packages/util/src/object/spread.ts @@ -4,18 +4,32 @@ /** * @name objectSpread * @summary Concats all sources into the destination + * @description Spreads object properties while maintaining object integrity */ export function objectSpread (dest: object, ...sources: (object | undefined | null)[]): T { + const filterProps = new Set(['__proto__', 'constructor', 'prototype']); + for (let i = 0, count = sources.length; i < count; i++) { const src = sources[i]; if (src) { if (typeof (src as Map).entries === 'function') { for (const [key, value] of (src as Map).entries()) { - (dest as Record)[key] = value; + if (!filterProps.has(key)) { + (dest as Record)[key] = value; + } } } else { - Object.assign(dest, src); + // Create a clean copy of the source object + const sanitizedSrc = Object.create(null) as Record; + + for (const [key, value] of Object.entries(src)) { + if (!filterProps.has(key)) { + sanitizedSrc[key] = value; + } + } + + Object.assign(dest, sanitizedSrc); } } }