Merge commit from fork

* disallow __proto__ property on object

* changeset

* changeset

Author: Rich-Harris

.changeset/huge-ads-study.md

@@ -0,0 +1,5 @@
+---
+'devalue': patch
+---
+
+fix: disallow array method access when parsing

.changeset/rich-clouds-walk.md

@@ -0,0 +1,5 @@
+---
+'devalue': patch
+---
+
+fix: disallow `__proto__` properties on objects

src/parse.js

@@ -44,7 +44,9 @@ export function unflatten(parsed, revivers) {
 		if (index === NEGATIVE_INFINITY) return -Infinity;
 		if (index === NEGATIVE_ZERO) return -0;
 
-		if (standalone) throw new Error(`Invalid input`);
+		if (standalone || typeof index !== 'number') {
+			throw new Error(`Invalid input`);
+		}
 
 		if (index in hydrated) return hydrated[index];
 
@@ -177,6 +179,10 @@ export function unflatten(parsed, revivers) {
 			hydrated[index] = object;
 
 			for (const key in value) {
+				if (key === '__proto__') {
+					throw new Error('Cannot parse an object with a `__proto__` property');
+				}
+
 				const n = value[key];
 				object[key] = hydrate(n);
 			}

test/test.js

@@ -681,6 +681,16 @@ const invalid = [
 		name: 'empty array',
 		json: '[]',
 		message: 'Invalid input'
+	},
+	{
+		name: 'prototype pollution',
+		json: '[{"__proto__":1},{}]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
+	{
+		name: 'bad index',
+		json: '[{"0":1,"toString":"push"},"hello"]',
+		message: 'Invalid input'
 	}
 ];