Fix array coercion with empty string, protect from prototype poisoning

hapipal / confidence

Dynamic, declarative configurations

Other

263 stars 43 forks source link

Closed devinivy closed 3 years ago

devinivy commented 3 years ago

Pulling some fixes out of #110 to ensure they land in v5:

Array coercion from string incorrectly interpreted '' into [''] rather than [].
JSON parsing during object coercion protects from prototype poisoning using bourne.