Basic pollution protection

Author: mde

lib/ejs.js

@@ -506,8 +506,8 @@ exports.clearCache = function () {
   exports.cache.reset();
 };
 
-function Template(text, opts) {
-  opts = opts || utils.createNullProtoObjWherePossible();
+function Template(text, optsParam) {
+  var opts = utils.hasOwnOnlyObject(optsParam);
   var options = utils.createNullProtoObjWherePossible();
   this.templateText = text;
   /** @type {string | null} */
@@ -949,3 +949,4 @@ exports.name = _NAME;
 if (typeof window != 'undefined') {
   window.ejs = exports;
 }
+

lib/utils.js

@@ -238,4 +238,13 @@ exports.createNullProtoObjWherePossible = (function () {
   };
 })();
 
+exports.hasOwnOnlyObject = function (obj) {
+  var o = exports.createNullProtoObjWherePossible();
+  for (var p in obj) {
+    if (hasOwn(obj, p)) {
+      o[p] = obj[p];
+    }
+  }
+  return o;
+};