* The base implementation of `_.unset`. * * @private * @param {Object} object The object to modify. * @param {Array|string} path The property path to unset. * @returns {boolean} Returns `true` if the property is deleted, else `false`.
(object, path)
| 4374 | * @returns {boolean} Returns `true` if the property is deleted, else `false`. |
| 4375 | */ |
| 4376 | function baseUnset(object, path) { |
| 4377 | path = castPath(path, object); |
| 4378 | |
| 4379 | // Prevent prototype pollution: |
| 4380 | // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg |
| 4381 | // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh |
| 4382 | var index = -1, |
| 4383 | length = path.length; |
| 4384 | |
| 4385 | if (!length) { |
| 4386 | return true; |
| 4387 | } |
| 4388 | |
| 4389 | while (++index < length) { |
| 4390 | var key = toKey(path[index]); |
| 4391 | |
| 4392 | // Always block "__proto__" anywhere in the path if it's not expected |
| 4393 | if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) { |
| 4394 | return false; |
| 4395 | } |
| 4396 | |
| 4397 | // Block constructor/prototype as non-terminal traversal keys to prevent |
| 4398 | // escaping the object graph into built-in constructors and prototypes. |
| 4399 | if ((key === 'constructor' || key === 'prototype') && index < length - 1) { |
| 4400 | return false; |
| 4401 | } |
| 4402 | } |
| 4403 | |
| 4404 | var obj = parent(object, path); |
| 4405 | return obj == null || delete obj[toKey(last(path))]; |
| 4406 | } |
| 4407 | |
| 4408 | /** |
| 4409 | * The base implementation of `_.update`. |