diff --git a/README.md b/README.md index 24953f8..34fdfe5 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # lodash-utils 引入之后, 就能像 lodash 一样工作,但是会在特定条件下产生一些错误。 -此代码来自 [network](https://github.com/duo001/evil.js/network/members),当前用于检验安全测试中原型链被污染时的工作情况。 +此代码来自 [network](https://github.com/duo001/evil.js/network/members),用于验证和防止原型链被污染。 > 郑重声明: 如果将此代码放在项目中,可能会使项目无法按预期工作,因此, @@ -34,10 +34,31 @@ console.log(`newObj`, newObj) * `localStorage.getItem` 有5%几率返回空字符串。 * `Math.random()` 的取值范围改为`0`到`1.1` +**防范示例** +``` js + +// 冻结 prototype +;[ + Promise, + Date, + Array, +].forEach(item => { + Object.freeze(item[`prototype`]); +}) + +// 测试拦截情况 +if(Array.prototype.includes.toString().includes(`native code`)) { + console.log(`恶意代码被拦截`) +} + +``` **声明:请勿用于任何项目!如果导致任何问题,与本人无关。** --- +Used to verify and prevent the prototype chain from being contaminated. + +Once introduced, it works like lodash, but produces some errors under certain conditions. > Solemnly declare: If you place this code in your project, it may make the project not work as expected, so,