add isValidKey function to ensure only valid keys are merged

Author: doowb

.travis.yml

@@ -17,4 +17,5 @@ node_js:
 matrix:
   fast_finish: true
   allow_failures:
+    - node_js: 'node'
     - node_js: '0.8'

index.js

@@ -32,7 +32,7 @@ module.exports = function mergeDeep(orig, objects) {
 
 function merge(target, obj) {
   for (var key in obj) {
-    if (key === '__proto__' || !hasOwn(obj, key)) {
+    if (!isValidKey(key) || !hasOwn(obj, key)) {
       continue;
     }
 
@@ -57,3 +57,7 @@ function hasOwn(obj, key) {
 function isObject(val) {
   return typeOf(val) === 'object' || typeOf(val) === 'function';
 }
+
+function isValidKey(key) {
+  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
+}