fix: Strip underscore prefixed fields from file contents

isaacs · isaacs · commit ac771d8cd663 · 2021-02-22T12:13:57.000-08:00
cc: @kumavis Related-to: npm/arborist#242 Credit: @isaacs Reviewed-by: @nlf
diff --git a/read-json.js b/read-json.js
@@ -95,6 +95,11 @@ function parseJson (file, er, d, log, strict, cb) {
 
   try {
     data = safeJSON(stripBOM(d))
+    for (var key in data) {
+      if (/^_/.test(key)) {
+        delete data[key]
+      }
+    }
   } catch (er) {
     data = parseIndex(d)
     if (!data) return cb(parseError(er, file))
diff --git a/test/fixtures/underscores.json b/test/fixtures/underscores.json
@@ -0,0 +1,5 @@
+{
+  "name": "underscore",
+  "version": "1.2.3",
+  "_lodash": true
+}
diff --git a/test/underscores.js b/test/underscores.js
@@ -0,0 +1,17 @@
+const t = require('tap')
+const rpj = require('../')
+const { resolve } = require('path')
+const fixture = resolve(__dirname, 'fixtures/underscores.json')
+t.test('strip underscores', t => {
+  rpj(fixture, (er, data) => {
+    if (er)
+      throw er
+    t.strictSame(data, {
+      _id: 'underscore@1.2.3',
+      name: 'underscore',
+      version: '1.2.3',
+      readme: 'ERROR: No README data found!'
+    })
+    t.end()
+  })
+})
