fix(decode): preserve __proto__ map keys as own properties#185
Open
spokodev wants to merge 1 commit into
Open
Conversation
Decoding a CBOR map with a "__proto__" text key assigned the value with `obj[key] = value`, which invokes the prototype setter on the plain object rather than creating an own property. The entry was silently dropped and the decoded object's prototype was mutated, so valid input did not round-trip. `rejectDuplicateMapKeys` also failed to reject repeated "__proto__" keys because the earlier assignment never created an own property for the duplicate check to find. Assign the "__proto__" key with a data property descriptor so it becomes a normal own enumerable property and the prototype is left untouched.
rvagg
reviewed
Jul 23, 2026
Comment on lines
+70
to
+71
| assert.strictEqual(obj.__proto__, 1) // eslint-disable-line no-proto | ||
| assert.strictEqual(Object.getPrototypeOf(obj), Object.prototype, 'prototype is unchanged') |
Owner
There was a problem hiding this comment.
You should run this without your change in decode.js, I'm pretty sure it'll pass anyway because __proto__ can only be set to an object or null, not primitives/scalars like 1.
Change the test to do something like __proto__ = {naughty:'obj'} (cborg cli tells me it would be a1695f5f70726f746f5f5fa1676e617567687479636f626a) and then I think you have a proper test.
Other than this, it's a good change @spokodev thanks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Decoding a CBOR map with a
"__proto__"text key assigned the value withobj[key] = value, which invokes the prototype setter on the plain object rather than creating an own property. The entry was silently dropped and the decoded object's prototype could be mutated, so valid input did not round trip.rejectDuplicateMapKeysalso failed to reject repeated"__proto__"keys because the earlier assignment never created an own property for the duplicate check to find.This assigns the key with a data property descriptor, so it becomes a normal own enumerable property and the prototype is left untouched. Adds tests for the round trip and the duplicate-key rejection.