Skip to content

Skip inherited properties in encodeQueryData - #10

Open
mmiermans wants to merge 1 commit into
exp/mozilla-optout-basefrom
exp/mz-optout
Open

Skip inherited properties in encodeQueryData#10
mmiermans wants to merge 1 commit into
exp/mozilla-optout-basefrom
exp/mz-optout

Conversation

@mmiermans

Copy link
Copy Markdown
Owner

The encodeQueryData helper iterates with for...in over the data object without an hasOwnProperty guard. If any polyfill or library extends Object.prototype with enumerable properties, those would leak into the serialized query string. Add an own-property check so only the object's own keys are encoded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant