githubmirror/lodash

_baseUnset.js
51 строка2 KB
Jon Church
chore: regenerate amd branch from main b9d70ee
30 мар 2026, 21:39
30 мар 2026, 21:39bbcf003
define(['./_castPath', './last', './_parent', './_toKey'], function(castPath, last, parent, toKey) {

  /** Used for built-in method references. */
  var objectProto = Object.prototype;

  /** Used to check objects for own properties. */
  var hasOwnProperty = objectProto.hasOwnProperty;

  /**
   * The base implementation of `_.unset`.
   *
   * @private
   * @param {Object} object The object to modify.
   * @param {Array|string} path The property path to unset.
   * @returns {boolean} Returns `true` if the property is deleted, else `false`.
   */
  function baseUnset(object, path) {
    path = castPath(path, object);

    // Prevent prototype pollution:
    // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
    // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
    // https://github.com/lodash/lodash/security/advisories/GHSA-w36w-cm3g-pc62
    var index = -1,
        length = path.length;

    if (!length) {
      return true;
    }

    while (++index < length) {
      var key = toKey(path[index]);

      // Always block "__proto__" anywhere in the path if it's not expected
      if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
        return false;
      }

      // Block constructor/prototype as non-terminal traversal keys to prevent
      // escaping the object graph into built-in constructors and prototypes.
      if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
        return false;
      }
    }

    var obj = parent(object, path);
    return obj == null || delete obj[toKey(last(path))];
  }

  return baseUnset;
});