Basic pollution protection

mde · Apr 12, 2024 · e469741 · e469741
1 parent 715e950
commit e469741
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/lib/ejs.js b/lib/ejs.js
@@ -506,8 +506,8 @@ exports.clearCache = function () {
  exports.cache.reset();
 };
 
-function Template(text, opts) {
- opts = opts || utils.createNullProtoObjWherePossible();
+function Template(text, optsParam) {
+ var opts = utils.hasOwnOnlyObject(optsParam);
  var options = utils.createNullProtoObjWherePossible();
  this.templateText = text;
  /** @type {string | null} */
@@ -949,3 +949,4 @@ exports.name = _NAME;
 if (typeof window != 'undefined') {
  window.ejs = exports;
 }
+
diff --git a/lib/utils.js b/lib/utils.js
@@ -238,4 +238,13 @@ exports.createNullProtoObjWherePossible = (function () {
  };
 })();
 
+exports.hasOwnOnlyObject = function (obj) {
+ var o = exports.createNullProtoObjWherePossible();
+ for (var p in obj) {
+ if (hasOwn(obj, p)) {
+ o[p] = obj[p];
+ }
+ }
+ return o;
+};