File tree Expand file tree Collapse file tree 2 files changed +3
-2
lines changed Expand file tree Collapse file tree 2 files changed +3
-2
lines changed Original file line number Diff line number Diff line change @@ -43,15 +43,16 @@ module.exports = function (bodyParser) {
43
43
return next ( err ) ;
44
44
}
45
45
46
- // Prevent setting __proto__ and constructor.prototype
47
46
if ( xml ) {
48
47
// Guard against prototype pollution
49
48
delete xml . __proto__ ;
50
49
delete xml . constructor ;
51
50
delete xml . prototype ;
52
51
52
+ // Set result on the request body
53
53
req . body = xml ;
54
54
}
55
+
55
56
next ( ) ;
56
57
} ) ;
57
58
} ) ;
Original file line number Diff line number Diff line change @@ -140,7 +140,7 @@ describe('XML Body Parser', function () {
140
140
. expect ( 200 , { parsed : { } } , done ) ;
141
141
} ) ;
142
142
143
- it ( 'should not set/change using __proto__ ' , function ( done ) {
143
+ it ( 'should not set/change using prototype ' , function ( done ) {
144
144
createServer ( ) ;
145
145
request ( app )
146
146
. post ( '/' )
You can’t perform that action at this time.
0 commit comments