Merge branch '5.x' into ignore-settings-on-object-prototype-5.x

expressjs · Apr 29, 2024 · 68cb997 · 68cb997
2 parents 790d083 + 1443973
commit 68cb997
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/lib/application.js b/lib/application.js
@@ -60,8 +60,8 @@ var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
 app.init = function init() {
   var router = null;
 
-  this.cache = {};
-  this.engines = {};
+  this.cache = Object.create(null);
+  this.engines = Object.create(null);
   this.settings = Object.create(null);
 
   this.defaultConfiguration();

diff --git a/test/app.locals.js b/test/app.locals.js
@@ -5,10 +5,11 @@ var express = require('../')
 
 describe('app', function(){
   describe('.locals', function () {
-    it('should default object', function () {
+    it('should default object with null prototype', function () {
       var app = express()
       assert.ok(app.locals)
       assert.strictEqual(typeof app.locals, 'object')
+      assert.strictEqual(Object.getPrototypeOf(app.locals), null)
     })
 
     describe('.settings', function () {