Accept any header name (inc. __proto__)

papaparse.js

@@ -1247,7 +1247,7 @@ License: MIT
 
 			function processRow(rowSource, i)
 			{
-				var row = _config.header ? {} : [];
+				var row = _config.header ? Object.create(null) : [];
 
 				var j;
 				for (j = 0; j < rowSource.length; j++)
@@ -1473,7 +1473,7 @@ License: MIT
 				var headers = firstLine.split(delim);
 				var separator = '_';
 				var headerMap = new Set();
-				var headerCount = {};
+				var headerCount = Object.create(null);
 				var duplicateHeaders = false;
 
 				for (var j in headers) {

tests/node-tests.js

@@ -5,6 +5,7 @@ var Papa = require("../papaparse.js");
 var fs = require('fs');
 var assert = require('assert');
 var longSampleRawCsv = fs.readFileSync(__dirname + '/long-sample.csv', 'utf8');
+var poisonedSampleRawCsv = fs.readFileSync(__dirname + '/poisoned-sample.csv', 'utf8');
 var utf8BomSampleRawCsv = fs.readFileSync(__dirname + '/utf-8-bom-sample.csv', 'utf8');
 
 function assertLongSampleParsedCorrectly(parsedCsv) {
@@ -298,4 +299,14 @@ describe('PapaParse', function() {
 			}
 		});
 	});
+
+	it('handles poisoned headers', function(done) {
+		Papa.parse(poisonedSampleRawCsv, {
+			header: true,
+			complete: function(parsedCsv) {
+				assert.deepEqual(parsedCsv.data[0], { ['__proto__']: 'X', toString: 'Y', valueOf: 'Z', __proto___1: 'A' });
+				done();
+			}
+		});
+	});
 });

tests/poisoned-sample.csv

@@ -0,0 +1,2 @@
+__proto__,toString,valueOf,__proto__
+X,Y,Z,A