Merge pull request #32 from magento-obsessive-owls/PB-718-1.3-develop

[1.3-develop] Update object-path

Author: omiroshnichenko

app/code/Magento/PageBuilder/view/adminhtml/web/js/resource/object-path.js

@@ -83,8 +83,15 @@
             }, {});
         };
 
-        function hasShallowProperty(obj, prop) {
-            return (options.includeInheritedProps || (typeof prop === 'number' && Array.isArray(obj)) || hasOwnProperty(obj, prop))
+        var hasShallowProperty
+        if (options.includeInheritedProps) {
+            hasShallowProperty = function () {
+                return true
+            }
+        } else {
+            hasShallowProperty = function (obj, prop) {
+                return (typeof prop === 'number' && Array.isArray(obj)) || hasOwnProperty(obj, prop)
+            }
         }
 
         function getShallowProperty(obj, prop) {
@@ -105,6 +112,10 @@
             }
             var currentPath = path[0];
             var currentValue = getShallowProperty(obj, currentPath);
+            if (options.includeInheritedProps && (currentPath === '__proto__' ||
+                (currentPath === 'constructor' && typeof currentValue === 'function'))) {
+                throw new Error('For security reasons, object\'s magic properties cannot be set')
+            }
             if (path.length === 1) {
                 if (currentValue === void 0 || !doNotReplace) {
                     obj[currentPath] = value;