skip __proto__ keys when creating an object

[ubeddulla]

JSON.parse gives you __proto__ as an own enumerable key, so it survives the Object.keys loop in initialize and lands on obj[keyName] = value, which runs the Object.prototype.__proto__ setter and re-parents the instance instead of setting a property. The setUnknownProperty branch just above can't catch it either, since '__proto__' in obj is always true. Concretely, SomeClass.create(JSON.parse('{"__proto__": {"isAdmin": true}}')) on a payload straight from a server currently throws obj.init is not a function because the instance no longer has a prototype, and the payload's keys are inherited where Object.keys can't see them. The same key also re-parents the merged hash in flattenProps, which then gets handed to the app's own init(props).

I put the skip in both loops rather than at the call sites since create is the entry point everyone reaches this through, and it matches the guard _getPath already has for the set path. Two tests in create_test.js cover it; both fail on main.

[NullVoxPopuli]

is this fixing a bug or anything you've encountered? wondering how this could come up