fix: Address prototype pollution vulnerability in merge function

[ohad2712]

I have verified that this lib's merge function has a Prototype Pollution vulnerability in predefine.

The vulnerable code: https://github.com/bigpipe/predefine/blob/0.1.2/index.js#L263-L294

PoC (Before):

const predefine = require('predefine');
predefine.merge({}, JSON.parse('{"__proto__": {"a": "b"}}'));

console.log(({}).a === 'b' ? 'exploitable' : 'unexploitable'); // exploitable

This PR edits the vulnerable place, and adds a test to make sure it is unexploiable.

[davedoesdev]

Seems sensible

[davedoesdev]

FYI: Published as @davedoesdev/predefine@0.1.3

[lpinca]

@Swaagie can you merge this and cut a new release if @3rd-Eden is ok with it?

[lpinca]

Also CCing: @indexzero

[lpinca]

@jcrugzz ?

[MateuszKikmunter]

Is this really solved @Swaagie? Still getting warnings in Synk reports. Could it be false positive vulnerability report?

[lpinca]

Is this really solved @Swaagie? Still getting warnings in Synk reports. Could it be false positive vulnerability report?

Yes, see 29851b6.

[MateuszKikmunter]

Is this really solved @Swaagie? Still getting warnings in Synk reports. Could it be false positive vulnerability report?

Yes, see 29851b6.

Thanks @lpinca !