CVE-2021-4278 (JavaScript, published 2022-12-25T16:15Z)
Description: value: A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/cronvel/tree-kit
Files changed:
CHANGELOG
browser/tree-kit.js
browser/tree-kit.min.js
package.json
Commit message: BREAKING CHANGE -- .path()/.dotPath(): drop the function's subtree support, fix prototype pollution


Vulnerable code:
	Copyright (c) 2014 - 2019 Cédric Ronvel
var tree = {} ;
},{"./clone.js":2,"./extend.js":3,"./path.js":4}],2:[function(require,module,exports){
	Copyright (c) 2014 - 2019 Cédric Ronvel
	Copyright (c) 2014 - 2019 Cédric Ronvel
},{}],4:[function(require,module,exports){
	Copyright (c) 2014 - 2019 Cédric Ronvel
var treePath = {} ;
treePath.op = function op( type , object , path , value ) {
	if ( ! object || ( typeof object !== 'object' && typeof object !== 'function' ) ) {
		return ;
	}
			if ( ! pointer[ key ] || ( typeof pointer[ key ] !== 'object' && typeof pointer[ key ] !== 'function' ) ) {

			if ( ! pointer[ key ] || ( typeof pointer[ key ] !== 'object' && typeof pointer[ key ] !== 'function' ) ) {
		if ( ! isArray ) { key = parts[ i ] ; continue ; }
				key = parts[ i ] ;
treePath.upgrade = function upgrade( object ) {
(function(e){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=e()}else if(typeof define==="function"&&define.amd){define([],e)}else{var t;if(typeof window!=="undefined"){t=window}else if(typeof global!=="undefined"){t=global}else if(typeof self!=="undefined"){t=self}else{t=this}t.treeKit=e()}})(function(){var e,t,n;return function(){function e(t,n,r){function i(o,u){if(!n[o]){if(!t[o]){var s="function"==typeof require&&require;if(!u&&s)return s(o,!0);if(f)return f(o,!0);var a=new Error("Cannot find module '"+o+"'");throw a.code="MODULE_NOT_FOUND",a}var c=n[o]={exports:{}};t[o][0].call(c.exports,function(e){var n=t[o][1][e];return i(n||e)},c,c.exports,e,t,n,r)}return n[o].exports}for(var f="function"==typeof require&&require,o=0;o<r.length;o++)i(r[o]);return i}return e}()({1:[function(e,t,n){"use strict";var r={};t.exports=r;r.extend=e("./extend.js");r.clone=e("./clone.js");r.path=e("./path.js")},{"./clone.js":2,"./extend.js":3,"./path.js":4}],2:[function(e,t,n){"use strict";function r(e,t){var n=Object.getPrototypeOf(e);if(r.opaque.has(n)){return r.opaque.get(n)(e)}var i,f,o,u,s,a,c=[{source:e,target:Array.isArray(e)?[]:Object.create(n)}],p=c[0].target,d=new Map;d.set(e,p);while(u=c.shift()){o=Object.getOwnPropertyNames(u.source);for(i=0;i<o.length;i++){f=Object.getOwnPropertyDescriptor(u.source,o[i]);if(!f.value||typeof f.value!=="object"){Object.defineProperty(u.target,o[i],f);continue}s=f.value;if(t){if(d.has(s)){f.value=d.get(s);Object.defineProperty(u.target,o[i],f);continue}}a=Object.getPrototypeOf(f.value);if(r.opaque.has(a)){f.value=r.opaque.get(a)(f.value);Object.defineProperty(u.target,o[i],f);continue}f.value=Array.isArray(s)?[]:Object.create(a);if(t){d.set(s,f.value)}Object.defineProperty(u.target,o[i],f);c.push({source:s,target:f.value})}}return p}t.exports=r;r.opaque=new Map;r.opaque.set(Date.prototype,e=>new Date(e))},{}],3:[function(e,t,n){"use strict";function r(e,t,...n){var r,f,o=false,u=n.length;if(!u){return t}if(!e||typeof e!=="object"){e={}}var s={depth:0,prefix:""};if(e.deep){if(Array.isArray(e.deep)){e.deep=new Set(e.deep)}else if(!(e.deep instanceof Set)){e.deep=true}}if(e.immutables){if(Array.isArray(e.immutables)){e.immutables=new Set(e.immutables)}else if(!(e.immutables instanceof Set)){delete e.immutables}}if(!e.maxDepth&&e.deep&&!e.circular){e.maxDepth=100}if(e.deepFunc){e.deep=true}if(e.flat){e.deep=true;e.proto=false;e.inherit=false;e.unflat=false;if(typeof e.flat!=="string"){e.flat="."}}if(e.unflat){e.deep=false;e.proto=false;e.inherit=false;e.flat=false;if(typeof e.unflat!=="string"){e.unflat="."}}if(e.inherit){e.own=true;e.proto=false}else if(e.proto){e.own=true}if(!t||typeof t!=="object"&&typeof t!=="function"){o=true}if(!e.skipRoot&&(e.inherit||e.proto)){for(r=u-1;r>=0;r--){f=n[r];if(f&&(typeof f==="object"||typeof f==="function")){if(e.inherit){if(o){t=Object.create(f)}else{Object.setPrototypeOf(t,f)}}else if(e.proto){if(o){t=Object.create(Object.getPrototypeOf(f))}else{Object.setPrototypeOf(t,Object.getPrototypeOf(f))}}break}}}else if(o){t={}}s.references={sources:[],targets:[]};for(r=0;r<u;r++){f=n[r];if(!f||typeof f!=="object"&&typeof f!=="function"){continue}i(s,e,t,f)}return t}t.exports=r;function i(e,t,n,r){var f,o,u,s,a,c,p,d,l,b,y,h=-1;if(t.maxDepth&&e.depth>t.maxDepth){throw new Error("[tree] extend(): max depth reached("+t.maxDepth+")")}if(t.circular){e.references.sources.push(r);e.references.targets.push(n)}if(t.own){if(t.nonEnum){u=Object.getOwnPropertyNames(r)}else{u=Object.keys(r)}}else{u=r}for(s in u){if(t.own){s=u[s]}if(s==="__proto__"){continue}if(t.descriptor){d=Object.getOwnPropertyDescriptor(r,s);a=d.value}else{a=r[s]}b=n;l=e.prefix+s;if(t.nofunc&&typeof a==="function"){continue}if(t.unflat&&e.depth===0){y=s.split(t.unflat);o=y.length-1;if(o){for(f=0;f<o;f++){if(!b[y[f]]||typeof b[y[f]]!=="object"&&typeof b[y[f]]!=="function"){b[y[f]]={}}b=b[y[f]]}l=e.prefix+y[o]}}if(t.deep&&a&&(typeof a==="object"||t.deepFunc&&typeof a==="function")&&(!t.descriptor||!d.get)&&((c=Object.getPrototypeOf(a))||true)&&(!(t.deep instanceof Set)||t.deep.has(c))&&(!t.immutables||!t.immutables.has(c))){if(t.circular){h=e.references.sources.indexOf(a)}if(t.flat){if(h>=0){continue}i({depth:e.depth+1,prefix:e.prefix+s+t.flat,references:e.references},t,b,a)}else{if(h>=0){if(t.descriptor){Object.defineProperty(b,l,{value:e.references.targets[h],enumerable:d.enumerable,writable:d.writable,configurable:d.configurable})}else{b[l]=e.references.targets[h]}continue}if(!b[l]||!Object.prototype.hasOwnProperty.call(b,l)||typeof b[l]!=="object"&&typeof b[l]!=="function"){if(Array.isArray(a)){p=[]}else if(t.proto){p=Object.create(c)}else if(t.inherit){p=Object.create(a)}else{p={}}if(t.descriptor){Object.defineProperty(b,l,{value:p,enumerable:d.enumerable,writable:d.writable,configurable:d.configurable})}else{b[l]=p}}else if(t.proto&&Object.getPrototypeOf(b[l])!==c){Object.setPrototypeOf(b[l],c)}else if(t.inherit&&Object.getPrototypeOf(b[l])!==a){Object.setPrototypeOf(b[l],a)}if(t.circular){e.references.sources.push(a);e.references.targets.push(b[l])}i({depth:e.depth+1,prefix:"",references:e.references},t,b[l],a)}}else if(t.preserve&&b[l]!==undefined){continue}else if(!t.inherit){if(t.descriptor){Object.defineProperty(b,l,d)}else{b[l]=a}}if(t.move){delete r[s]}}}},{}],4:[function(e,t,n){"use strict";var r={};t.exports=r;r.op=function e(t,n,r,i){var f,o,u,s,a,c=false,p=false,d,l=true;if(!n||typeof n!=="object"&&typeof n!=="function"){return}if(typeof r==="string"){if(r){o=r.match(/([.#[\]]|[^.#[\]]+)/g)}else{o=[""]}if(o[0]==="."){o.unshift("")}if(o[o.length-1]==="."){o.push("")}}else if(Array.isArray(r)){o=r;p=true}else{throw new TypeError("[tree.path] ."+t+"(): the path argument should be a string or an array")}switch(t){case"get":case"delete":d=false;break;case"set":case"define":case"inc":case"dec":case"append":case"prepend":case"concat":case"insert":case"autoPush":d=true;break;default:throw new TypeError("[tree.path] .op(): wrong type of operation '"+t+"'")}s=n;u=o.length-1;for(f=0;f<=u;f++){if(p){if(a===undefined){a=o[f];continue}if(!s[a]||typeof s[a]!=="object"&&typeof s[a]!=="function"){if(!d){return undefined}s[a]={}}s=s[a];a=o[f];continue}else if(o[f]==="."){c=false;if(a===undefined){if(!l){l=true;continue}a=""}if(!s[a]||typeof s[a]!=="object"&&typeof s[a]!=="function"){if(!d){return undefined}s[a]={}}s=s[a];l=true;continue}else if(o[f]==="#"||o[f]==="["){c=true;l=false;if(a===undefined){if(!Array.isArray(s)){return undefined}continue}if(!s[a]||!Array.isArray(s[a])){if(!d){return undefined}s[a]=[]}s=s[a];continue}else if(o[f]==="]"){l=false;continue}l=false;if(!c){a=o[f];continue}switch(o[f]){case"length":a=o[f];break;case"first":a=0;break;case"last":a=s.length-1;if(a<0){a=0}break;case"next":if(!d){return undefined}a=s.length;break;case"insert":if(!d){return undefined}s.unshift(undefined);a=0;break;default:a=parseInt(o[f],10)}}switch(t){case"get":return s[a];case"delete":if(c&&typeof a==="number"){s.splice(a,1)}else{delete s[a]}return;case"set":s[a]=i;return s[a];case"define":if(!(a in s)){s[a]=i}return s[a];case"inc":if(typeof s[a]==="number"){s[a]++}else if(!s[a]||typeof s[a]!=="object"){s[a]=1}return s[a];case"dec":if(typeof s[a]==="number"){s[a]--}else if(!s[a]||typeof s[a]!=="object"){s[a]=-1}return s[a];case"append":if(!s[a]){s[a]=[i]}else if(Array.isArray(s[a])){s[a].push(i)}return s[a];case"prepend":if(!s[a]){s[a]=[i]}else if(Array.isArray(s[a])){s[a].unshift(i)}return s[a];case"concat":if(!s[a]){s[a]=i}else if(Array.isArray(s[a])&&Array.isArray(i)){s[a]=s[a].concat(i)}return s[a];case"insert":if(!s[a]){s[a]=i}else if(Array.isArray(s[a])&&Array.isArray(i)){s[a]=i.concat(s[a])}return s[a];case"autoPush":if(s[a]===undefined){s[a]=i}else if(Array.isArray(s[a])){s[a].push(i)}else{s[a]=[s[a],i]}return s[a]}};r.get=r.op.bind(undefined,"get");r.delete=r.op.bind(undefined,"delete");r.set=r.op.bind(undefined,"set");r.define=r.op.bind(undefined,"define");r.inc=r.op.bind(undefined,"inc");r.dec=r.op.bind(undefined,"dec");r.append=r.op.bind(undefined,"append");r.prepend=r.op.bind(undefined,"prepend");r.concat=r.op.bind(undefined,"concat");r.insert=r.op.bind(undefined,"insert");r.autoPush=r.op.bind(undefined,"autoPush");r.prototype={get:function(e){return r.get(this,e)},delete:function(e){return r.delete(this,e)},set:function(e,t){return r.set(this,e,t)},define:function(e,t){return r.define(this,e,t)},inc:function(e,t){return r.inc(this,e,t)},dec:function(e,t){return r.dec(this,e,t)},append:function(e,t){return r.append(this,e,t)},prepend:function(e,t){return r.prepend(this,e,t)},concat:function(e,t){return r.concat(this,e,t)},insert:function(e,t){return r.insert(this,e,t)},autoPush:function(e,t){return r.autoPush(this,e,t)}};r.upgrade=function e(t){Object.defineProperties(t,{get:{value:r.op.bind(undefined,"get",t)},delete:{value:r.op.bind(undefined,"delete",t)},set:{value:r.op.bind(undefined,"set",t)},define:{value:r.op.bind(undefined,"define",t)},inc:{value:r.op.bind(undefined,"inc",t)},dec:{value:r.op.bind(undefined,"dec",t)},append:{value:r.op.bind(undefined,"append",t)},prepend:{value:r.op.bind(undefined,"prepend",t)},concat:{value:r.op.bind(undefined,"concat",t)},insert:{value:r.op.bind(undefined,"insert",t)},autoPush:{value:r.op.bind(undefined,"autoPush",t)}})}},{}]},{},[1])(1)});
  "version": "0.6.2",

Fixed code:
v0.7.0
------

BREAKING CHANGE -- .path()/.dotPath(): drop the function's subtree support, fix prototype pollution


	Copyright (c) 2014 - 2021 Cédric Ronvel
const tree = {} ;

tree.dotPath = require( './dotPath.js' ) ;

},{"./clone.js":2,"./dotPath.js":3,"./extend.js":4,"./path.js":5}],2:[function(require,module,exports){
	Copyright (c) 2014 - 2021 Cédric Ronvel
	Copyright (c) 2014 - 2021 Cédric Ronvel

	The MIT License (MIT)

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:

	The above copyright notice and this permission notice shall be included in all
	copies or substantial portions of the Software.

	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
	SOFTWARE.
*/

"use strict" ;



const dotPath = {} ;
module.exports = dotPath ;



const EMPTY_PATH = [] ;
const PROTO_POLLUTION_MESSAGE = 'This would pollute prototype' ;



function toPathArray( path ) {
	if ( Array.isArray( path ) ) { return path ; }
	else if ( ! path ) { return EMPTY_PATH ; }
	else if ( typeof path === 'string' ) { return path.split( '.' ) ; }

	throw new TypeError( '[tree.dotPath]: the path argument should be a string or an array' ) ;
}



// Walk the tree using the path array.
function walk( object , pathArray , maxOffset = 0 ) {
	var i , iMax , key ,
		pointer = object ;

	for ( i = 0 , iMax = pathArray.length + maxOffset ; i < iMax ; i ++ ) {
		key = pathArray[ i ] ;

		if ( key === '__proto__' || typeof pointer === 'function' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
		if ( ! pointer || typeof pointer !== 'object' ) { return undefined ; }

		pointer = pointer[ key ] ;
	}

	return pointer ;
}



// Walk the tree, create missing element: pave the path up to before the last part of the path.
// Return that before-the-last element.
// Object MUST be an object! no check are performed for the first step!
function pave( object , pathArray ) {
	var i , iMax , key ,
		pointer = object ;

	for ( i = 0 , iMax = pathArray.length - 1 ; i < iMax ; i ++ ) {
		key = pathArray[ i ] ;

		if ( key === '__proto__' || typeof pointer[ key ] === 'function' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
		if ( ! pointer[ key ] || typeof pointer[ key ] !== 'object' ) { pointer[ key ] = {} ; }

		pointer = pointer[ key ] ;
	}

	return pointer ;
}



dotPath.get = ( object , path ) => walk( object , toPathArray( path ) ) ;



dotPath.set = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	pointer[ key ] = value ;

	return value ;
} ;



dotPath.define = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( ! ( key in pointer ) ) { pointer[ key ] = value ; }

	return value ;
} ;



dotPath.inc = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( typeof pointer[ key ] === 'number' ) { pointer[ key ] ++ ; }
	else if ( ! pointer[ key ] || typeof pointer[ key ] !== 'object' ) { pointer[ key ] = 1 ; }

	return value ;
} ;



dotPath.dec = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( typeof pointer[ key ] === 'number' ) { pointer[ key ] -- ; }
	else if ( ! pointer[ key ] || typeof pointer[ key ] !== 'object' ) { pointer[ key ] = -1 ; }

	return value ;
} ;



dotPath.concat = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( ! pointer[ key ] ) { pointer[ key ] = value ; }
	else if ( Array.isArray( pointer[ key ] ) && Array.isArray( value ) ) {
		pointer[ key ] = pointer[ key ].concat( value ) ;
	}
	//else ? do nothing???

	return value ;
} ;



dotPath.insert = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( ! pointer[ key ] ) { pointer[ key ] = value ; }
	else if ( Array.isArray( pointer[ key ] ) && Array.isArray( value ) ) {
		pointer[ key ] = value.concat( pointer[ key ] ) ;
	}
	//else ? do nothing???

	return value ;
} ;



dotPath.delete = ( object , path ) => {
	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = walk( object , pathArray , -1 ) ;

	if ( ! pointer || typeof pointer !== 'object' ) { return false ; }

	return delete pointer[ key ] ;
} ;



dotPath.autoPush = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( pointer[ key ] === undefined ) { pointer[ key ] = value ; }
	else if ( Array.isArray( pointer[ key ] ) ) { pointer[ key ].push( value ) ; }
	else { pointer[ key ] = [ pointer[ key ] , value ] ; }

	return pointer[ key ] ;
} ;



dotPath.append = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( ! pointer[ key ] ) { pointer[ key ] = [ value ] ; }
	else if ( Array.isArray( pointer[ key ] ) ) { pointer[ key ].push( value ) ; }
	//else ? do nothing???

	return pointer[ key ] ;
} ;



dotPath.prepend = ( object , path , value ) => {
	if ( ! object || typeof object !== 'object' ) {
		// Throw?
		return undefined ;
	}

	var pathArray = toPathArray( path ) ,
		key = pathArray[ pathArray.length - 1 ] ;

	if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }

	var pointer = pave( object , pathArray ) ;

	if ( ! pointer[ key ] ) { pointer[ key ] = [ value ] ; }
	else if ( Array.isArray( pointer[ key ] ) ) { pointer[ key ].unshift( value ) ; }
	//else ? do nothing???

	return pointer[ key ] ;
} ;


},{}],4:[function(require,module,exports){
/*
	Tree Kit

	Copyright (c) 2014 - 2021 Cédric Ronvel
},{}],5:[function(require,module,exports){
	Copyright (c) 2014 - 2021 Cédric Ronvel
const treePath = {} ;
const PROTO_POLLUTION_MESSAGE = 'This would pollute prototype' ;



treePath.op = function( type , object , path , value ) {
	if ( ! object || typeof object !== 'object' ) { return ; }
				if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
			if ( typeof pointer[ key ] === 'function' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
			if ( ! pointer[ key ] || typeof pointer[ key ] !== 'object' ) {
			if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
			if ( typeof pointer[ key ] === 'function' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
			if ( ! pointer[ key ] || typeof pointer[ key ] !== 'object' ) {
			if ( typeof pointer[ key ] === 'function' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
		if ( ! isArray ) {
			key = parts[ i ] ;
			if ( key === '__proto__' ) { throw new Error( PROTO_POLLUTION_MESSAGE ) ; }
			continue ;
		}
				key = 'length' ;
treePath.upgrade = function( object ) {
(function(e){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=e()}else if(typeof define==="function"&&define.amd){define([],e)}else{var t;if(typeof window!=="undefined"){t=window}else if(typeof global!=="undefined"){t=global}else if(typeof self!=="undefined"){t=self}else{t=this}t.treeKit=e()}})(function(){var e,t,r;return function(){function e(t,r,n){function i(f,u){if(!r[f]){if(!t[f]){var a="function"==typeof require&&require;if(!u&&a)return a(f,!0);if(o)return o(f,!0);var s=new Error("Cannot find module '"+f+"'");throw s.code="MODULE_NOT_FOUND",s}var c=r[f]={exports:{}};t[f][0].call(c.exports,function(e){var r=t[f][1][e];return i(r||e)},c,c.exports,e,t,r,n)}return r[f].exports}for(var o="function"==typeof require&&require,f=0;f<n.length;f++)i(n[f]);return i}return e}()({1:[function(e,t,r){"use strict";const n={};t.exports=n;n.extend=e("./extend.js");n.clone=e("./clone.js");n.path=e("./path.js");n.dotPath=e("./dotPath.js")},{"./clone.js":2,"./dotPath.js":3,"./extend.js":4,"./path.js":5}],2:[function(e,t,r){"use strict";function n(e,t){var r=Object.getPrototypeOf(e);if(n.opaque.has(r)){return n.opaque.get(r)(e)}var i,o,f,u,a,s,c=[{source:e,target:Array.isArray(e)?[]:Object.create(r)}],p=c[0].target,d=new Map;d.set(e,p);while(u=c.shift()){f=Object.getOwnPropertyNames(u.source);for(i=0;i<f.length;i++){o=Object.getOwnPropertyDescriptor(u.source,f[i]);if(!o.value||typeof o.value!=="object"){Object.defineProperty(u.target,f[i],o);continue}a=o.value;if(t){if(d.has(a)){o.value=d.get(a);Object.defineProperty(u.target,f[i],o);continue}}s=Object.getPrototypeOf(o.value);if(n.opaque.has(s)){o.value=n.opaque.get(s)(o.value);Object.defineProperty(u.target,f[i],o);continue}o.value=Array.isArray(a)?[]:Object.create(s);if(t){d.set(a,o.value)}Object.defineProperty(u.target,f[i],o);c.push({source:a,target:o.value})}}return p}t.exports=n;n.opaque=new Map;n.opaque.set(Date.prototype,e=>new Date(e))},{}],3:[function(e,t,r){"use strict";const n={};t.exports=n;const i=[];const o="This would pollute prototype";function f(e){if(Array.isArray(e)){return e}else if(!e){return i}else if(typeof e==="string"){return e.split(".")}throw new TypeError("[tree.dotPath]: the path argument should be a string or an array")}function u(e,t,r=0){var n,i,f,u=e;for(n=0,i=t.length+r;n<i;n++){f=t[n];if(f==="__proto__"||typeof u==="function"){throw new Error(o)}if(!u||typeof u!=="object"){return undefined}u=u[f]}return u}function a(e,t){var r,n,i,f=e;for(r=0,n=t.length-1;r<n;r++){i=t[r];if(i==="__proto__"||typeof f[i]==="function"){throw new Error(o)}if(!f[i]||typeof f[i]!=="object"){f[i]={}}f=f[i]}return f}n.get=((e,t)=>u(e,f(t)));n.set=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);u[i]=r;return r});n.define=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(!(i in u)){u[i]=r}return r});n.inc=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(typeof u[i]==="number"){u[i]++}else if(!u[i]||typeof u[i]!=="object"){u[i]=1}return r});n.dec=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(typeof u[i]==="number"){u[i]--}else if(!u[i]||typeof u[i]!=="object"){u[i]=-1}return r});n.concat=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(!u[i]){u[i]=r}else if(Array.isArray(u[i])&&Array.isArray(r)){u[i]=u[i].concat(r)}return r});n.insert=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(!u[i]){u[i]=r}else if(Array.isArray(u[i])&&Array.isArray(r)){u[i]=r.concat(u[i])}return r});n.delete=((e,t)=>{var r=f(t),n=r[r.length-1];if(n==="__proto__"){throw new Error(o)}var i=u(e,r,-1);if(!i||typeof i!=="object"){return false}return delete i[n]});n.autoPush=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(u[i]===undefined){u[i]=r}else if(Array.isArray(u[i])){u[i].push(r)}else{u[i]=[u[i],r]}return u[i]});n.append=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(!u[i]){u[i]=[r]}else if(Array.isArray(u[i])){u[i].push(r)}return u[i]});n.prepend=((e,t,r)=>{if(!e||typeof e!=="object"){return undefined}var n=f(t),i=n[n.length-1];if(i==="__proto__"){throw new Error(o)}var u=a(e,n);if(!u[i]){u[i]=[r]}else if(Array.isArray(u[i])){u[i].unshift(r)}return u[i]})},{}],4:[function(e,t,r){"use strict";function n(e,t,...r){var n,o,f=false,u=r.length;if(!u){return t}if(!e||typeof e!=="object"){e={}}var a={depth:0,prefix:""};if(e.deep){if(Array.isArray(e.deep)){e.deep=new Set(e.deep)}else if(!(e.deep instanceof Set)){e.deep=true}}if(e.immutables){if(Array.isArray(e.immutables)){e.immutables=new Set(e.immutables)}else if(!(e.immutables instanceof Set)){delete e.immutables}}if(!e.maxDepth&&e.deep&&!e.circular){e.maxDepth=100}if(e.deepFunc){e.deep=true}if(e.flat){e.deep=true;e.proto=false;e.inherit=false;e.unflat=false;if(typeof e.flat!=="string"){e.flat="."}}if(e.unflat){e.deep=false;e.proto=false;e.inherit=false;e.flat=false;if(typeof e.unflat!=="string"){e.unflat="."}}if(e.inherit){e.own=true;e.proto=false}else if(e.proto){e.own=true}if(!t||typeof t!=="object"&&typeof t!=="function"){f=true}if(!e.skipRoot&&(e.inherit||e.proto)){for(n=u-1;n>=0;n--){o=r[n];if(o&&(typeof o==="object"||typeof o==="function")){if(e.inherit){if(f){t=Object.create(o)}else{Object.setPrototypeOf(t,o)}}else if(e.proto){if(f){t=Object.create(Object.getPrototypeOf(o))}else{Object.setPrototypeOf(t,Object.getPrototypeOf(o))}}break}}}else if(f){t={}}a.references={sources:[],targets:[]};for(n=0;n<u;n++){o=r[n];if(!o||typeof o!=="object"&&typeof o!=="function"){continue}i(a,e,t,o)}return t}t.exports=n;function i(e,t,r,n){var o,f,u,a,s,c,p,d,l,y,h,b=-1;if(t.maxDepth&&e.depth>t.maxDepth){throw new Error("[tree] extend(): max depth reached("+t.maxDepth+")")}if(t.circular){e.references.sources.push(n);e.references.targets.push(r)}if(t.own){if(t.nonEnum){u=Object.getOwnPropertyNames(n)}else{u=Object.keys(n)}}else{u=n}for(a in u){if(t.own){a=u[a]}if(a==="__proto__"){continue}if(t.descriptor){d=Object.getOwnPropertyDescriptor(n,a);s=d.value}else{s=n[a]}y=r;l=e.prefix+a;if(t.nofunc&&typeof s==="function"){continue}if(t.unflat&&e.depth===0){h=a.split(t.unflat);f=h.length-1;if(f){for(o=0;o<f;o++){if(!y[h[o]]||typeof y[h[o]]!=="object"&&typeof y[h[o]]!=="function"){y[h[o]]={}}y=y[h[o]]}l=e.prefix+h[f]}}if(t.deep&&s&&(typeof s==="object"||t.deepFunc&&typeof s==="function")&&(!t.descriptor||!d.get)&&((c=Object.getPrototypeOf(s))||true)&&(!(t.deep instanceof Set)||t.deep.has(c))&&(!t.immutables||!t.immutables.has(c))){if(t.circular){b=e.references.sources.indexOf(s)}if(t.flat){if(b>=0){continue}i({depth:e.depth+1,prefix:e.prefix+a+t.flat,references:e.references},t,y,s)}else{if(b>=0){if(t.descriptor){Object.defineProperty(y,l,{value:e.references.targets[b],enumerable:d.enumerable,writable:d.writable,configurable:d.configurable})}else{y[l]=e.references.targets[b]}continue}if(!y[l]||!Object.prototype.hasOwnProperty.call(y,l)||typeof y[l]!=="object"&&typeof y[l]!=="function"){if(Array.isArray(s)){p=[]}else if(t.proto){p=Object.create(c)}else if(t.inherit){p=Object.create(s)}else{p={}}if(t.descriptor){Object.defineProperty(y,l,{value:p,enumerable:d.enumerable,writable:d.writable,configurable:d.configurable})}else{y[l]=p}}else if(t.proto&&Object.getPrototypeOf(y[l])!==c){Object.setPrototypeOf(y[l],c)}else if(t.inherit&&Object.getPrototypeOf(y[l])!==s){Object.setPrototypeOf(y[l],s)}if(t.circular){e.references.sources.push(s);e.references.targets.push(y[l])}i({depth:e.depth+1,prefix:"",references:e.references},t,y[l],s)}}else if(t.preserve&&y[l]!==undefined){continue}else if(!t.inherit){if(t.descriptor){Object.defineProperty(y,l,d)}else{y[l]=s}}if(t.move){delete n[a]}}}},{}],5:[function(e,t,r){"use strict";const n={};t.exports=n;const i="This would pollute prototype";n.op=function(e,t,r,n){var o,f,u,a,s,c=false,p=false,d,l=true;if(!t||typeof t!=="object"){return}if(typeof r==="string"){if(r){f=r.match(/([.#[\]]|[^.#[\]]+)/g)}else{f=[""]}if(f[0]==="."){f.unshift("")}if(f[f.length-1]==="."){f.push("")}}else if(Array.isArray(r)){f=r;p=true}else{throw new TypeError("[tree.path] ."+e+"(): the path argument should be a string or an array")}switch(e){case"get":case"delete":d=false;break;case"set":case"define":case"inc":case"dec":case"append":case"prepend":case"concat":case"insert":case"autoPush":d=true;break;default:throw new TypeError("[tree.path] .op(): wrong type of operation '"+e+"'")}a=t;u=f.length-1;for(o=0;o<=u;o++){if(p){if(s===undefined){s=f[o];if(s==="__proto__"){throw new Error(i)}continue}if(typeof a[s]==="function"){throw new Error(i)}if(!a[s]||typeof a[s]!=="object"){if(!d){return undefined}a[s]={}}a=a[s];s=f[o];if(s==="__proto__"){throw new Error(i)}continue}else if(f[o]==="."){c=false;if(s===undefined){if(!l){l=true;continue}s=""}if(typeof a[s]==="function"){throw new Error(i)}if(!a[s]||typeof a[s]!=="object"){if(!d){return undefined}a[s]={}}a=a[s];l=true;continue}else if(f[o]==="#"||f[o]==="["){c=true;l=false;if(s===undefined){if(!Array.isArray(a)){return undefined}continue}if(typeof a[s]==="function"){throw new Error(i)}if(!a[s]||!Array.isArray(a[s])){if(!d){return undefined}a[s]=[]}a=a[s];continue}else if(f[o]==="]"){l=false;continue}l=false;if(!c){s=f[o];if(s==="__proto__"){throw new Error(i)}continue}switch(f[o]){case"length":s="length";break;case"first":s=0;break;case"last":s=a.length-1;if(s<0){s=0}break;case"next":if(!d){return undefined}s=a.length;break;case"insert":if(!d){return undefined}a.unshift(undefined);s=0;break;default:s=parseInt(f[o],10)}}switch(e){case"get":return a[s];case"delete":if(c&&typeof s==="number"){a.splice(s,1)}else{delete a[s]}return;case"set":a[s]=n;return a[s];case"define":if(!(s in a)){a[s]=n}return a[s];case"inc":if(typeof a[s]==="number"){a[s]++}else if(!a[s]||typeof a[s]!=="object"){a[s]=1}return a[s];case"dec":if(typeof a[s]==="number"){a[s]--}else if(!a[s]||typeof a[s]!=="object"){a[s]=-1}return a[s];case"append":if(!a[s]){a[s]=[n]}else if(Array.isArray(a[s])){a[s].push(n)}return a[s];case"prepend":if(!a[s]){a[s]=[n]}else if(Array.isArray(a[s])){a[s].unshift(n)}return a[s];case"concat":if(!a[s]){a[s]=n}else if(Array.isArray(a[s])&&Array.isArray(n)){a[s]=a[s].concat(n)}return a[s];case"insert":if(!a[s]){a[s]=n}else if(Array.isArray(a[s])&&Array.isArray(n)){a[s]=n.concat(a[s])}return a[s];case"autoPush":if(a[s]===undefined){a[s]=n}else if(Array.isArray(a[s])){a[s].push(n)}else{a[s]=[a[s],n]}return a[s]}};n.get=n.op.bind(undefined,"get");n.delete=n.op.bind(undefined,"delete");n.set=n.op.bind(undefined,"set");n.define=n.op.bind(undefined,"define");n.inc=n.op.bind(undefined,"inc");n.dec=n.op.bind(undefined,"dec");n.append=n.op.bind(undefined,"append");n.prepend=n.op.bind(undefined,"prepend");n.concat=n.op.bind(undefined,"concat");n.insert=n.op.bind(undefined,"insert");n.autoPush=n.op.bind(undefined,"autoPush");n.prototype={get:function(e){return n.get(this,e)},delete:function(e){return n.delete(this,e)},set:function(e,t){return n.set(this,e,t)},define:function(e,t){return n.define(this,e,t)},inc:function(e,t){return n.inc(this,e,t)},dec:function(e,t){return n.dec(this,e,t)},append:function(e,t){return n.append(this,e,t)},prepend:function(e,t){return n.prepend(this,e,t)},concat:function(e,t){return n.concat(this,e,t)},insert:function(e,t){return n.insert(this,e,t)},autoPush:function(e,t){return n.autoPush(this,e,t)}};n.upgrade=function(e){Object.defineProperties(e,{get:{value:n.op.bind(undefined,"get",e)},delete:{value:n.op.bind(undefined,"delete",e)},set:{value:n.op.bind(undefined,"set",e)},define:{value:n.op.bind(undefined,"define",e)},inc:{value:n.op.bind(undefined,"inc",e)},dec:{value:n.op.bind(undefined,"dec",e)},append:{value:n.op.bind(undefined,"append",e)},prepend:{value:n.op.bind(undefined,"prepend",e)},concat:{value:n.op.bind(undefined,"concat",e)},insert:{value:n.op.bind(undefined,"insert",e)},autoPush:{value:n.op.bind(undefined,"autoPush",e)}})}},{}]},{},[1])(1)});
  "version": "0.7.0",