@bpmn-io/form-js-editor 1.8.1 → 1.8.2

package/dist/index.es.js

@@ -8981,6 +8981,14 @@ function textToLabel(text) {
 function isValidDotPath(path) {
   return /^\w+(\.\w+)*$/.test(path);
 }
+
+/**
+  * @param {string} path
+  */
+function isProhibitedPath(path) {
+  const prohibitedSegments = ['__proto__', 'prototype', 'constructor'];
+  return path.split('.').some(segment => prohibitedSegments.includes(segment));
+}
 const LABELED_NON_INPUTS = ['button', 'group', 'dynamiclist', 'iframe', 'table'];
 const INPUTS = ['checkbox', 'checklist', 'datetime', 'number', 'radio', 'select', 'taglist', 'textfield', 'textarea'];
 const OPTIONS_INPUTS = ['checklist', 'radio', 'select', 'taglist'];
@@ -9920,6 +9928,9 @@ function Key$2(props) {
     if (hasIntegerPathSegment(value)) {
       return 'Must not contain numerical path segments.';
     }
+    if (isProhibitedPath(value)) {
+      return 'Must not be a prohibited path.';
+    }
     const replacements = {
       [field.id]: value.split('.')
     };
@@ -10012,11 +10023,15 @@ function Path(props) {
     }
 
     // Check for integer segments in the path
-    const hasIntegerPathSegment = value.split('.').some(segment => /^\d+$/.test(segment));
-    if (hasIntegerPathSegment) {
+    if (hasIntegerPathSegment(value)) {
       return 'Must not contain numerical path segments.';
     }
 
+    // Check for special prohibited paths
+    if (isProhibitedPath(value)) {
+      return 'Must not be a prohibited path.';
+    }
+
     // Check for path collisions
     const options = {
       replacements: {