paypro: root certs - do not inherit from Object.

browser/root-certs

@@ -34,6 +34,8 @@ function getRootCerts(callback) {
           + '"' + key + '":\n';
     });
     body += ''
+      + '\n'
+      + 'certs.__proto__ = null;\n'
       + '\n'
       + '// Use hash table for efficiency:\n'
       + 'var trusted = Object.keys(certs).reduce(function(trusted, key) {\n'
@@ -43,18 +45,21 @@ function getRootCerts(callback) {
       + '  pem = pem.replace(/\\s+/g, "");\n'
       + '  trusted[pem] = key;\n'
       + '  return trusted;\n'
-      + '}, {});\n'
+      + '}, { __proto__: null });\n'
       + '\n'
       + 'function getTrusted(pem) {\n'
       + '  pem = pem + "";\n'
       + '  pem = pem.replace(/-----BEGIN CERTIFICATE-----/g, "");\n'
       + '  pem = pem.replace(/-----END CERTIFICATE-----/g, "");\n'
       + '  pem = pem.replace(/\\s+/g, "");\n'
+      + '  if (pem === "__proto__") return;\n'
       + '  return certs[pem];\n'
       + '}\n'
       + '\n'
       + 'function getCert(name) {\n'
-      + '  return trusted[name.replace(/^\s+|\s+$/g, "")];\n'
+      + '  name = name.replace(/^\s+|\s+$/g, "");\n'
+      + '  if (name === "__proto__") return;\n'
+      + '  return trusted[name];\n'
       + '}\n'
       + '\n'
       + 'exports.certs = certs;\n'

lib/common/RootCerts.js

@@ -3704,6 +3704,8 @@ var certs = {
 + "-----END CERTIFICATE-----\n"
 };
 
+certs.__proto__ = null;
+
 // Use hash table for efficiency:
 var trusted = Object.keys(certs).reduce(function(trusted, key) {
   var pem = certs[key];
@@ -3712,18 +3714,21 @@ var trusted = Object.keys(certs).reduce(function(trusted, key) {
   pem = pem.replace(/\s+/g, "");
   trusted[pem] = key;
   return trusted;
-}, {});
+}, { __proto__: null });
 
 function getTrusted(pem) {
   pem = pem + "";
   pem = pem.replace(/-----BEGIN CERTIFICATE-----/g, "");
   pem = pem.replace(/-----END CERTIFICATE-----/g, "");
   pem = pem.replace(/\s+/g, "");
+  if (pem === "__proto__") return;
   return certs[pem];
 }
 
 function getCert(name) {
-  return trusted[name.replace(/^s+|s+$/g, "")];
+  name = name.replace(/^s+|s+$/g, "");
+  if (name === "__proto__") return;
+  return trusted[name];
 }
 
 exports.certs = certs;