From a6f57c7301c64a8fa32e8287355c7e60565e5fda Mon Sep 17 00:00:00 2001 From: wll8 Date: Thu, 18 Aug 2022 16:55:25 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E6=B7=BB=E5=8A=A0=E9=98=B2=E8=8C=83?= =?UTF-8?q?=E7=A4=BA=E4=BE=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 24953f8..34fdfe5 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # lodash-utils 引入之后, 就能像 lodash 一样工作,但是会在特定条件下产生一些错误。 -此代码来自 [network](https://github.com/duo001/evil.js/network/members),当前用于检验安全测试中原型链被污染时的工作情况。 +此代码来自 [network](https://github.com/duo001/evil.js/network/members),用于验证和防止原型链被污染。 > 郑重声明: 如果将此代码放在项目中,可能会使项目无法按预期工作,因此, @@ -34,10 +34,31 @@ console.log(`newObj`, newObj) * `localStorage.getItem` 有5%几率返回空字符串。 * `Math.random()` 的取值范围改为`0`到`1.1` +**防范示例** +``` js + +// 冻结 prototype +;[ + Promise, + Date, + Array, +].forEach(item => { + Object.freeze(item[`prototype`]); +}) + +// 测试拦截情况 +if(Array.prototype.includes.toString().includes(`native code`)) { + console.log(`恶意代码被拦截`) +} + +``` **声明:请勿用于任何项目!如果导致任何问题,与本人无关。** --- +Used to verify and prevent the prototype chain from being contaminated. + +Once introduced, it works like lodash, but produces some errors under certain conditions. > Solemnly declare: If you place this code in your project, it may make the project not work as expected, so,