From 79cc0757ad1dc48bf9610ea04d4c3accbd6c64c9 Mon Sep 17 00:00:00 2001
From: Claudia Hardman <cjhard@gmail.com>
Date: Tue, 18 Aug 2015 13:26:36 -0400
Subject: [PATCH] Prevent sending Object prototype methods as XML

Adds `Object.prototype.hasOwnProperty` check in `WSDL.prototype.objectToRpcXML` and `WSDL.prototype.objectToXML`.

This prevents sending arbitrary Javascript has XML nodes.
---
 lib/wsdl.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/wsdl.js b/lib/wsdl.js
index 7eccade33..7d11fb59c 100644
--- a/lib/wsdl.js
+++ b/lib/wsdl.js
@@ -1451,6 +1451,7 @@ WSDL.prototype.objectToRpcXML = function(name, params, namespace, xmlns) {
   parts.push(['<', namespace, name, '>'].join(''));
 
   for (var key in params) {
+    if (!params.hasOwnProperty(key)) continue;
     if (key !== nsAttrName) {
       var value = params[key];
       parts.push(['<', key, '>'].join(''));
@@ -1513,6 +1514,7 @@ WSDL.prototype.objectToXML = function(obj, name, namespace, xmlns, first, xmlnsA
     }
   } else if (typeof obj === 'object') {
     for (name in obj) {
+      if (!obj.hasOwnProperty(name)) continue;
       //don't process attributes as element
       if (name === self.options.attributesKey) {
         continue;