CVE-2025-48054

@@ -85,6 +85,7 @@ export * from './object/crush.ts'
 export * from './object/filterKey.ts'
 export * from './object/get.ts'
 export * from './object/invert.ts'
+export * from './object/isDangerousKey.ts'
 export * from './object/keys.ts'
 export * from './object/listify.ts'
 export * from './object/lowerize.ts'

@@ -0,0 +1,17 @@
+/**
+ * Check if a property key is “dangerous” in the sense that it could
+ * be used to modify built-in objects, possibly leading to prototype
+ * pollution or other unintended side effects.
+ *
+ * If you pass an object, it will be checked for a `null` prototype,
+ * in which case, the key will be considered safe.
+ *
+ * @see https://radashi.js.org/reference/object/isDangerousKey
+ * @version 12.5.1
+ */
+export function isDangerousKey(key: PropertyKey, object?: object): boolean {
+  return (
+    !(object && !Object.getPrototypeOf(object)) &&
+    (key === '__proto__' || key === 'prototype' || key === 'constructor')
+  )
+}

@@ -1,4 +1,4 @@
-import { clone, isIntString } from 'radashi'
+import { clone, isDangerousKey, isIntString } from 'radashi'
 
 /**
  * Opposite of get, dynamically set a nested value into an object
@@ -28,6 +28,10 @@ export function set<T extends object, K>(
 
     object ??= isIntString(key) ? [] : {}
 
+    if (isDangerousKey(key, object)) {
+      throw new Error('Unsafe key in path: ' + key)
+    }
+
     if (index < keys.length - 1) {
       value = recurse(object[key], keys, index + 1)
     }

@@ -93,11 +93,34 @@ describe('set', () => {
     })
   })
 
-  test('prototype pollution', () => {
-    const prototype: any = {}
-    _.set(Object.create(prototype), '__proto__.polluted', true)
+  test('prototype pollution is forbidden', () => {
+    expect(() => _.set({}, '__proto__.polluted', true)).toThrowError(
+      'Unsafe key in path: __proto__',
+    )
+    expect(() => _.set({}, 'prototype.polluted', true)).toThrowError(
+      'Unsafe key in path: prototype',
+    )
 
-    expect(prototype.polluted).toBeUndefined()
-    expect('polluted' in prototype).toBe(false)
+    // Prototype-less objects don't care:
+    let obj = Object.create(null)
+
+    obj = _.set(obj, '__proto__.polluted', true)
+    expect(Object.getPrototypeOf(obj)).toBe(null)
+    expect(obj.__proto__).toEqual({ polluted: true })
+
+    obj = _.set(obj, 'prototype.polluted', true)
+    expect(Object.getPrototypeOf(obj)).toBe(null)
+    expect(obj.prototype).toEqual({ polluted: true })
+  })
+
+  test('constructor pollution is forbidden', () => {
+    expect(() => _.set({}, 'constructor.polluted', true)).toThrowError(
+      'Unsafe key in path: constructor',
+    )
+
+    // Prototype-less objects don't care:
+    let obj = Object.create(null)
+    obj = _.set(obj, 'constructor.polluted', true)
+    expect(obj.constructor).toEqual({ polluted: true })
   })
 })