From 19145d59e69e409e7d63dd2694f779d116bd5db6 Mon Sep 17 00:00:00 2001
From: Mark Riedesel <mark@klowner.com>
Date: Fri, 30 Oct 2015 11:13:17 -0500
Subject: [PATCH] Use deep clones for data in Storage

---
 lib/chrome/StorageArea.js            |  6 +++---
 test/unit/lib/chrome/Storage.spec.js | 30 ++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/lib/chrome/StorageArea.js b/lib/chrome/StorageArea.js
index 3561228..2ee5af8 100644
--- a/lib/chrome/StorageArea.js
+++ b/lib/chrome/StorageArea.js
@@ -45,7 +45,7 @@ function StorageArea(chrome, storage, namespace) {
     var result = get(this._store, keys);
 
     defer(function () {
-      callback(result);
+      callback(_.cloneDeep(result));
     });
   });
 
@@ -77,10 +77,10 @@ function StorageArea(chrome, storage, namespace) {
         oldValue: this._store[key],
         newValue: items[key]
       };
-      this._store[key] = items[key];
+      this._store[key] = _.cloneDeep(items[key]);
     }
 
-    storage.onChanged.trigger(changes, namespace);
+    storage.onChanged.trigger(_.cloneDeep(changes), namespace);
 
     return (callback && defer(callback));
   });
diff --git a/test/unit/lib/chrome/Storage.spec.js b/test/unit/lib/chrome/Storage.spec.js
index aa026a9..0e94e8e 100644
--- a/test/unit/lib/chrome/Storage.spec.js
+++ b/test/unit/lib/chrome/Storage.spec.js
@@ -123,6 +123,36 @@ describe('chrome.storage', function () {
     });
   });
 
+  describe('storage data isolation', function () {
+    var mock;
+
+    before(function () {
+      api = new Storage();
+      mock = {
+        alpha: { user: { name: 'Hamburglar', pass: 'r0bbl3r0bble' } },
+        isNew: true
+      };
+    });
+
+    it('modifying original data after storing should not alter data in storage', function (done) {
+      api.sync.set(mock, function () {
+        mock.alpha.user.name = 'Grimmace';
+        hmt.assert.notEqual(mock.alpha.user.name, api.sync._store.alpha.user.name);
+        done();
+      });
+    });
+
+    it('modifying results should not alter the data in storage', function (done) {
+      api.sync.set(mock, function () {
+        api.sync.get(['alpha'], function (result) {
+          result.alpha.user.name = 'Ronald';
+          hmt.assert.notEqual(api.sync._store.alpha.user.name, 'Ronald');
+          done();
+        });
+      });
+    });
+  });
+
   describe('remove()', function () {
     beforeEach(function (done) {
       api = new Storage();