Patch taken from https://github.com/DanielRuf/snyk-js-jquery-174006?files=1
and left in-repo. Note that this will break the foreign resources check,
which is not currently a unit test but was planned to become such soon.
Bug: T221739
Change-Id: I99c2be81c74a8f1d35c421f0ee43c75efb30a7d0
--- /dev/null
+--- jquery-3.3.1.js 2019-04-01 08:39:29.000000000 +0200
++++ jquery-3.3.1.js 2019-04-01 09:02:39.000000000 +0200
+@@ -260,8 +260,9 @@ jQuery.extend = jQuery.fn.extend = function() {
+ for ( name in options ) {
+ src = target[ name ];
+ copy = options[ name ];
+
++ // Prevent Object.prototype pollution
+ // Prevent never-ending loop
+- if ( target === copy ) {
++ if ( name === "__proto__" || target === copy ) {
+ continue;
+ }
+
src = target[ name ];
copy = options[ name ];
+ // Prevent Object.prototype pollution
// Prevent never-ending loop
- if ( target === copy ) {
+ if ( name === "__proto__" || target === copy ) {
continue;
}