@mparticle/web-sdk 3.6.2 → 3.7.0

package/src/types.ts

@@ -558,6 +558,20 @@ export function getEventCategoryFromCustomEventType(
     }
 }
 
+// A stored `ui` key is the decimal string of an IdentityType; anything else was
+// not written by this SDK. The round-trip comparison is load bearing: parseNumber
+// returns 0 for any non-numeric key and IdentityType.Other is 0, so after parsing
+// alone a stored "hasOwnProperty" is indistinguishable from a genuine Other entry.
+export function getIdentityTypeFromStoredKey(key: string): number | null {
+    const identityType = parseNumber(key);
+
+    if (String(identityType) !== key || !IdentityType.isValid(identityType)) {
+        return null;
+    }
+
+    return identityType;
+}
+
 export function getIdentityTypeFromBatchKey(
     key: string
 ): number {

package/src/utils.ts

@@ -44,7 +44,7 @@ const findKeyInObject = (obj: any, key: string): string => {
     if (key && obj) {
         for (var prop in obj) {
             if (
-                obj.hasOwnProperty(prop) &&
+                hasOwnProp(obj, prop) &&
                 prop.toLowerCase() === key.toLowerCase()
             ) {
                 return prop;
@@ -246,8 +246,13 @@ const WEB_SAFE_BASE64_REPLACEMENTS: Dictionary<string> = {
     '=': '',
 };
 
-const toWebSafeBase64 = (value: string): string =>
-    btoa(value).replace(/[+/=]/g, c => WEB_SAFE_BASE64_REPLACEMENTS[c]);
+// btoa is defined only over Latin-1 and throws InvalidCharacterError above U+00FF
+const isLatin1 = (value: string): boolean => !/[^\u0000-\u00ff]/.test(value);
+
+const toWebSafeBase64 = (value: string): string | undefined =>
+    isLatin1(value)
+        ? btoa(value).replace(/[+/=]/g, c => WEB_SAFE_BASE64_REPLACEMENTS[c])
+        : undefined;
 
 // FIXME: REFACTOR for V3
 // only used in store.js to sanitize server-side formatting of
@@ -316,9 +321,26 @@ const moveElementToEnd = <T>(array: T[], index: number): T[] =>
 // does not compile under this project's `lib: ["es5", "es6", "dom"]`; widening that
 // would emit a call absent from every browser before 2021, and this same file still
 // carries a fallback for browsers with no URLSearchParams.
-const hasOwnProp = (obj: object, key: string): boolean =>
+const hasOwnProp = (obj: object, key: PropertyKey): boolean =>
     Object.prototype.hasOwnProperty.call(obj, key);
 
+// Assigning `__proto__` replaces the target's prototype instead of adding an own
+// property; `constructor` is reserved alongside it by the stored-record contract.
+// `prototype` is deliberately absent: isValidKeyValue accepts it, so setUserAttribute
+// persists it and the getters must hand it back.
+const isReservedStoredPropertyName = (name: string): boolean =>
+    name === '__proto__' || name === 'constructor';
+
+// extend's historical set, which additionally refuses `prototype` when merging.
+const isUncopyableMergeName = (name: string): boolean =>
+    isReservedStoredPropertyName(name) || name === 'prototype';
+
+// Kit-facing copies stay compatible with conventional own-property iteration, such as
+// attributes.hasOwnProperty(key), which is the one read pattern an attribute of that name
+// interferes with. The public getters keep the name; only this filter drops it.
+const isReservedKitPropertyName = (name: string): boolean =>
+    isReservedStoredPropertyName(name) || name === 'hasOwnProperty';
+
 const queryStringParser = (
     url: string,
     keys: string[] = []
@@ -446,7 +468,7 @@ const filterDictionaryWithHash = <T>(
 
     if (!isEmpty(dictionary)) {
         for (const key in dictionary) {
-            if (dictionary.hasOwnProperty(key)) {
+            if (hasOwnProp(dictionary, key) && !isReservedKitPropertyName(key)) {
                 const hashedKey = hashFn(key);
                 if (!inArray(filterList, hashedKey)) {
                     filtered[key] = dictionary[key];
@@ -612,11 +634,7 @@ function extend(...args: any[]): any {
     for (; i < length; i++) {
         if ((options = args[i]) != null) {
             for (name in options) {
-                if (
-                    name === '__proto__' ||
-                    name === 'constructor' ||
-                    name === 'prototype'
-                ) {
+                if (isUncopyableMergeName(name)) {
                     continue;
                 }
 
@@ -721,6 +739,7 @@ export {
     moveElementToEnd,
     queryStringParser,
     hasOwnProp,
+    isReservedStoredPropertyName,
     getCookies,
     getHref,
     replaceMPID,