Fix potential prototype pollution in expandObjectPaths

src/lib/index.js

@@ -933,6 +933,7 @@ lib.expandObjectPaths = function(data) {
                 if((match = key.match(dottedPropertyRegex))) {
                     datum = data[key];
                     prop = match[1];
+                    if(prop === '__proto__') continue;
 
                     delete data[key];
 
@@ -941,6 +942,8 @@ lib.expandObjectPaths = function(data) {
                     datum = data[key];
 
                     prop = match[1];
+                    if(prop === '__proto__') continue;
+
                     idx = parseInt(match[2]);
 
                     delete data[key];
@@ -969,9 +972,12 @@ lib.expandObjectPaths = function(data) {
                     } else {
                         // This is the case where this property is the end of the line,
                         // e.g. xaxis.range[0]
+
+                        if(prop === '__proto__') continue;
                         data[prop][idx] = lib.expandObjectPaths(datum);
                     }
                 } else {
+                    if(key === '__proto__') continue;
                     data[key] = lib.expandObjectPaths(data[key]);
                 }
             }

test/jasmine/tests/animate_test.js

@@ -708,6 +708,56 @@ describe('Animate API details', function() {
     });
 });
 
+describe('Animate expandObjectPaths do not pollute prototype', function() {
+    'use strict';
+
+    var gd;
+
+    beforeEach(function() {
+        gd = createGraphDiv();
+    });
+
+    afterEach(function() {
+        Plotly.purge(gd);
+        destroyGraphDiv();
+    });
+
+    it('should not pollute prototype - layout object', function(done) {
+        Plotly.newPlot(gd, {
+            data: [{y: [1, 3, 2]}]
+        }).then(function() {
+            return Plotly.animate(gd, {
+                transition: {duration: 10},
+                data: [{y: [2, 3, 1]}],
+                traces: [0],
+                layout: {'__proto__.polluted': true}
+            });
+        }).then(function() {
+            setTimeout(function() {
+                var a = {};
+                expect(a.polluted).toBeUndefined();
+            }, 100);
+        }).then(done, done.fail);
+    });
+
+    it('should not pollute prototype - data object', function(done) {
+        Plotly.newPlot(gd, {
+            data: [{y: [1, 3, 2]}]
+        }).then(function() {
+            return Plotly.animate(gd, {
+                transition: {duration: 10},
+                data: [{y: [2, 3, 1], '__proto__.polluted': true}],
+                traces: [0]
+            });
+        }).then(function() {
+            setTimeout(function() {
+                var a = {};
+                expect(a.polluted).toBeUndefined();
+            }, 100);
+        }).then(done, done.fail);
+    });
+});
+
 describe('Animating multiple axes', function() {
     var gd;