@almadar/evaluator 2.11.2 → 2.12.1

package/dist/index.js

@@ -33,7 +33,13 @@ function resolveBinding(binding, ctx) {
     return void 0;
   }
   const withoutPrefix = binding.slice(1);
-  const parts = withoutPrefix.split(".");
+  const parts = withoutPrefix.split(".").flatMap((seg) => {
+    const m = seg.match(/^([\w]+)((?:\[\d+\])+)$/);
+    if (!m) return [seg];
+    const head = m[1];
+    const indices = Array.from(m[2].matchAll(/\[(\d+)\]/g)).map((x) => x[1]);
+    return [head, ...indices];
+  });
   const root = parts[0];
   const path = parts.slice(1);
   if (CLIENT_ONLY_BINDING_ROOTS.has(root)) {
@@ -1204,6 +1210,7 @@ function evalArrayDropLast(args, evaluate2, ctx) {
 }
 
 // std/object.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function evalLambda(lambdaExpr, evaluate2, ctx, ...values) {
   if (!isSExpr(lambdaExpr) || getOperator(lambdaExpr) !== "fn") {
     return evaluate2(lambdaExpr, ctx);
@@ -1266,6 +1273,9 @@ function evalObjectSet(args, evaluate2, ctx) {
   if (!path) return obj ?? {};
   const result = structuredClone(obj ?? {});
   const parts = path.split(".");
+  if (parts.some((p) => FORBIDDEN_KEYS.has(p))) {
+    return result;
+  }
   let current = result;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -1303,6 +1313,7 @@ function evalObjectDeepMerge(args, evaluate2, ctx) {
   function deepMerge(target, source) {
     const result = { ...target };
     for (const key of Object.keys(source)) {
+      if (FORBIDDEN_KEYS.has(key)) continue;
       if (source[key] !== null && typeof source[key] === "object" && !Array.isArray(source[key]) && target[key] !== null && typeof target[key] === "object" && !Array.isArray(target[key])) {
         result[key] = deepMerge(
           target[key],