CVE-2020-28460: Prototype pollution in multi-ini

The vulnerability stems from insufficient key validation in the INI parsing logic. The commit diff shows the regex pattern REGEXP_IGNORE_KEYS was expanded from checking only proto to include 'constructor' and 'prototype'. Before this fix, the parser would process keys containing 'constructor.proto' or 'prototype', allowing prototype pollution through specially crafted INI files. The Snyk PoC demonstrates this using '[constructor] prototype.polluted' syntax. The core vulnerability exists in the key validation logic within the Parser class in parser.js that handles property assignment.