@maestro-js/form 1.0.0-alpha.23 → 1.0.0-alpha.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +5 -1
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -654,12 +654,16 @@ import set2 from "es-toolkit/compat/set";
|
|
|
654
654
|
// src/json-schema-helpers.ts
|
|
655
655
|
import get from "es-toolkit/compat/get";
|
|
656
656
|
import set from "es-toolkit/compat/set";
|
|
657
|
+
var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
|
|
658
|
+
function isSafeFormKey(key) {
|
|
659
|
+
return key.split(".").every((segment) => !FORBIDDEN_KEY_SEGMENTS.has(segment));
|
|
660
|
+
}
|
|
657
661
|
function parseJsonSchemaFormData(schema, formData) {
|
|
658
662
|
const flat = flattenJsonSchema(schema);
|
|
659
663
|
const booleans = flat.filter((f) => resolvedType(f.schema) === "boolean");
|
|
660
664
|
const arrays = flat.filter((f) => resolvedType(f.schema) === "array" && !f.optional && !f.path.includes(".*."));
|
|
661
665
|
const keys = [...arrays.map((a) => a.path), ...new Set(formData.keys())];
|
|
662
|
-
const rawEntries = keys.filter((key) => key !== "__formId").map((key) => {
|
|
666
|
+
const rawEntries = keys.filter((key) => key !== "__formId").filter((key) => isSafeFormKey(key)).map((key) => {
|
|
663
667
|
const match = flat.find((f) => formPathsMatch(key, f.path));
|
|
664
668
|
return [key, coerceFormValue(match?.schema, formData.getAll(key))];
|
|
665
669
|
});
|