Skip to content

Prevent object prototype pollution #799

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattbaileyuk merged 1 commit into from
May 19, 2026
+35 −35
Merged

Prevent object prototype pollution #799

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions src/datetime.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ const dateTime = (function () {
return words;
}

const wordValues = {};
const wordValues = Object.create(null);
few.forEach(function (word, index) {
wordValues[word.toLowerCase()] = index;
});
Expand Down Expand Up @@ -952,11 +952,11 @@ const dateTime = (function () {
* @returns {object} - regex
*/
function generateRegex(formatSpec) {
var matcher = {};
var matcher = Object.create(null);
if (formatSpec.type === 'datetime') {
matcher.type = 'datetime';
matcher.parts = formatSpec.parts.map(function (part) {
var res = {};
var res = Object.create(null);
if (part.type === 'literal') {
res.regex = part.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
} else if (part.component === 'Z' || part.component === 'z') {
Expand Down Expand Up @@ -1004,7 +1004,7 @@ const dateTime = (function () {
} else {
// must be a month or day name
res.regex = '[a-zA-Z]+';
var lookup = {};
var lookup = Object.create(null);
if (part.component === 'M' || part.component === 'x') {
// months
months.forEach(function (name, index) {
Expand Down Expand Up @@ -1187,7 +1187,7 @@ const dateTime = (function () {
const tmA = 23; // binary 010111
const tmB = 47; // binary 101111

const components = {};
const components = Object.create(null);
for (let i = 1; i < info.length; i++) {
const mpart = matchSpec.parts[i - 1];
if (mpart.parse) {
Expand Down
16 changes: 8 additions & 8 deletions src/functions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1662,7 +1662,7 @@ const functions = (() => {

if (Array.isArray(arg)) {
// merge the keys of all of the items in the array
var merge = {};
var merge = Object.create(null);
for(var ii = 0; ii < arg.length; ii++) {
var allkeys = keys.call(this, arg[ii]);
allkeys.forEach(function (key) {
Expand Down Expand Up @@ -1754,8 +1754,8 @@ const functions = (() => {
result = append.call(this, result, spread.call(this, arg[ii]));
}
} else if (arg !== null && typeof arg === 'object' && !isLambda(arg)) {
for (var key in arg) {
var obj = {};
for (const key of Object.keys(arg)) {
var obj = Object.create(null);
obj[key] = arg[key];
result.push(obj);
}
Expand All @@ -1777,10 +1777,10 @@ const functions = (() => {
return undefined;
}

var result = {};
var result = Object.create(null);

arg.forEach(function (obj) {
for (var prop in obj) {
for (const prop of Object.keys(obj)) {
result[prop] = obj[prop];
}
});
Expand Down Expand Up @@ -1820,7 +1820,7 @@ const functions = (() => {
async function each(obj, func) {
var result = this.createSequence();

for (var key in obj) {
for (const key of Object.keys(obj)) {
var func_args = hofFuncArgs(func, obj[key], key, obj);
// invoke func
var val = await func.apply(this, func_args);
Expand Down Expand Up @@ -2047,9 +2047,9 @@ const functions = (() => {
* @returns {object} - sifted object
*/
async function sift(arg, func) {
var result = {};
var result = Object.create(null);

for (var item in arg) {
for (const item of Object.keys(arg)) {
var entry = arg[item];
var func_args = hofFuncArgs(func, entry, item, arg);
// invoke func
Expand Down
38 changes: 19 additions & 19 deletions src/jsonata.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,7 @@ var jsonata = (function() {
resultSequence.keepSingleton = true;
}

if (expr.hasOwnProperty('group')) {
if (Object.prototype.hasOwnProperty.call(expr, 'group')) {
resultSequence = await evaluateGroupExpression(expr.group, isTupleStream ? tupleBindings : resultSequence, environment)
}

Expand All @@ -228,7 +228,7 @@ var jsonata = (function() {

function createFrameFromTuple(environment, tuple) {
var frame = createFrame(environment);
for(const prop in tuple) {
for(const prop of Object.keys(tuple)) {
frame.bind(prop, tuple[prop]);
}
return frame;
Expand Down Expand Up @@ -271,13 +271,13 @@ var jsonata = (function() {
resultSequence = result[0];
} else {
// flatten the sequence
result.forEach(function(res) {
Array.prototype.forEach.call(result, function(res) {
if (!Array.isArray(res) || res.cons) {
// it's not an array - just push into the result sequence
resultSequence.push(res);
} else {
// res is a sequence - flatten it into the parent sequence
res.forEach(val => resultSequence.push(val));
Array.prototype.forEach.call(res, val => resultSequence.push(val));
}
});
}
Expand Down Expand Up @@ -349,7 +349,7 @@ var jsonata = (function() {
res = [res];
}
for (var bb = 0; bb < res.length; bb++) {
tuple = {};
tuple = Object.create(null);
Object.assign(tuple, tupleBindings[ee]);
if(res.tupleStream) {
Object.assign(tuple, res[bb]);
Expand Down Expand Up @@ -422,7 +422,7 @@ var jsonata = (function() {
res = [res];
}
if (isArrayOfNumbers(res)) {
res.forEach(function (ires) {
Array.prototype.forEach.call(res, function (ires) {
// round it down
var ii = Math.floor(ires);
if (ii < 0) {
Expand Down Expand Up @@ -633,7 +633,7 @@ var jsonata = (function() {
flattened = [];
}
if(Array.isArray(arg)) {
arg.forEach(function (item) {
Array.prototype.forEach.call(arg, function (item) {
flatten(item, flattened);
});
} else {
Expand Down Expand Up @@ -674,7 +674,7 @@ var jsonata = (function() {
results.push(input);
}
if (Array.isArray(input)) {
input.forEach(function (member) {
Array.prototype.forEach.call(input, function (member) {
recurseDescendants(member, results);
});
} else if (input !== null && typeof input === 'object') {
Expand Down Expand Up @@ -909,8 +909,8 @@ var jsonata = (function() {
* @returns {{}} Evaluated input data
*/
async function evaluateGroupExpression(expr, input, environment) {
var result = {};
var groups = {};
var result = Object.create(null);
var groups = Object.create(null);
var reduce = input && input.tupleStream ? true : false;
var focus = {
createSequence: environment.base.createSequence
Expand Down Expand Up @@ -942,7 +942,7 @@ var jsonata = (function() {

if (key !== undefined) {
var entry = {data: item, exprIndex: pairIndex};
if (groups.hasOwnProperty(key)) {
if (Object.prototype.hasOwnProperty.call(groups, key)) {
// a value already exists in this slot
if(groups[key].exprIndex !== pairIndex) {
// this key has been generated by another expression in this group
Expand Down Expand Up @@ -993,13 +993,13 @@ var jsonata = (function() {
if(!Array.isArray(tupleStream)) {
return tupleStream;
}
var result = {};
var result = Object.create(null);
var focus = {
createSequence: environment.base.createSequence
};
Object.assign(result, tupleStream[0]);
for(var ii = 1; ii < tupleStream.length; ii++) {
for(const prop in tupleStream[ii]) {
for(const prop of Object.keys(tupleStream[ii])) {
result[prop] = fn.append.call(focus, result[prop], tupleStream[ii][prop]);
}
}
Expand Down Expand Up @@ -1333,7 +1333,7 @@ var jsonata = (function() {
};
}
// merge the update
for(var prop in update) {
for(const prop of Object.keys(update)) {
match[prop] = update[prop];
}
}
Expand Down Expand Up @@ -1670,7 +1670,7 @@ var jsonata = (function() {
async function applyProcedure(proc, args) {
var result;
var env = createFrame(proc.environment);
proc.arguments.forEach(function (param, index) {
Array.prototype.forEach.call(proc.arguments, function (param, index) {
env.bind(param.value, args[index]);
});
if (typeof proc.body === 'function') {
Expand All @@ -1692,7 +1692,7 @@ var jsonata = (function() {
// create a closure, bind the supplied parameters and return a function that takes the remaining (?) parameters
var env = createFrame(proc.environment || environment);
var unboundArgs = [];
proc.arguments.forEach(function (param, index) {
Array.prototype.forEach.call(proc.arguments, function (param, index) {
var arg = args[index];
if (arg && arg.type === 'operator' && arg.value === '?') {
unboundArgs.push(param);
Expand Down Expand Up @@ -1855,14 +1855,14 @@ var jsonata = (function() {
* @returns {{bind: bind, lookup: lookup}} Created frame
*/
function createFrame(enclosingEnvironment) {
var bindings = {};
var bindings = Object.create(null);
const newFrame = {
bind: function (name, value) {
bindings[name] = value;
},
lookup: function (name) {
var value;
if(bindings.hasOwnProperty(name)) {
if(Object.prototype.hasOwnProperty.call(bindings, name)) {
value = bindings[name];
} else if (enclosingEnvironment) {
value = enclosingEnvironment.lookup(name);
Expand Down Expand Up @@ -2143,7 +2143,7 @@ var jsonata = (function() {
var exec_env;
// the variable bindings have been passed in - create a frame to hold these
exec_env = createFrame(environment);
for (var v in bindings) {
for (const v of Object.keys(bindings)) {
exec_env.bind(v, bindings[v]);
}
} else {
Expand Down
2 changes: 1 addition & 1 deletion src/parser.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,7 @@ const parser = (() => {
var node;
var lexer;

var symbol_table = {};
var symbol_table = Object.create(null);
var errors = [];

var remainingTokens = function () {
Expand Down
4 changes: 2 additions & 2 deletions src/signature.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ const signature = (() => {
// step through the signature, one symbol at a time
var position = 1;
var params = [];
var param = {};
var param = Object.create(null);
var prevParam = param;
while (position < signature.length) {
var symbol = signature.charAt(position);
Expand All @@ -44,7 +44,7 @@ const signature = (() => {
var next = function () {
params.push(param);
prevParam = param;
param = {};
param = Object.create(null);
};

var findClosingBracket = function (str, start, openSymbol, closeSymbol) {
Expand Down
Loading