@node-red/util 4.1.13 → 4.1.14

package/lib/util.js

@@ -24,7 +24,6 @@ const jsonata = require("jsonata");
 const moment = require("moment-timezone");
 const safeJSONStringify = require("json-stringify-safe");
 const util = require("util");
-const { hasOwnProperty } = Object.prototype;
 const log = require("./log")
 /**
  * Safely returns the object constructor name.
@@ -182,7 +181,7 @@ function compareObjects(obj1,obj2) {
     }
     for (var k in obj1) {
         /* istanbul ignore else */
-        if (hasOwnProperty.call(obj1, k)) {
+        if (Object.hasOwn(obj1, k)) {
             if (!compareObjects(obj1[k],obj2[k])) {
                 return false;
             }
@@ -473,7 +472,7 @@ function setObjectProperty(msg,prop,value,createMissing) {
     for (var i=0;i<length-1;i++) {
         key = msgPropParts[i];
         if (typeof key === 'string' || (typeof key === 'number' && !Array.isArray(obj))) {
-            if (hasOwnProperty.call(obj, key)) {
+            if (Object.hasOwn(obj, key)) {
                 if (length > 1 && ((typeof obj[key] !== "object" && typeof obj[key] !== "function") || obj[key] === null)) {
                     // Break out early as we cannot create a property beneath
                     // this type of value
@@ -570,7 +569,7 @@ function getSetting(node, name, flow_) {
  * @memberof @node-red/util_util
  */
 function evaluateEnvProperty(value, node) {
-    var flow = (node && hasOwnProperty.call(node, "_flow")) ? node._flow : null;
+    var flow = (node && Object.hasOwn(node, "_flow")) ? node._flow : null;
     var result;
     if (/^\${[^}]+}$/.test(value)) {
         // ${ENV_VAR}
@@ -782,12 +781,59 @@ function evaluateJSONataExpression(expr,msg,callback) {
     }
 
     expr.evaluate(context, bindings).then(result => {
-        callback(null, result)
+        callback(null, normaliseJSONataResult(result, new WeakSet()))
     }).catch(err => {
         callback(err)
     })
 }
 
+/**
+ * Restore the standard Object prototype on any object created by JSONata.
+ *
+ * JSONata 2.2.1 hardened itself against prototype pollution by building its
+ * internal objects with `Object.create(null)`. Those objects surface in the
+ * expression result, so anything downstream calling `obj.hasOwnProperty(...)` -
+ * or relying on `toString` - will throw. We cannot assume code outside our
+ * control avoids that, so the prototype is restored before the result is
+ * handed back.
+ *
+ * The result must be walked, not just checked at the top level: JSONata leaves
+ * null-prototype objects nested inside plain objects and, commonly, as the
+ * members of a returned array (`items.{...}`, `$map(...)`, `$append(...)`).
+ *
+ * Only plain objects and arrays are traversed. Buffers, Dates and class
+ * instances are passed through untouched: JSONata never places a constructed
+ * object inside one, and walking them would be expensive (a Buffer has one own
+ * key per byte) and unsafe (property getters on msg.req/msg.res may have side
+ * effects).
+ *
+ * @param  {any}     value - the JSONata result to normalise, modified in place
+ * @param  {WeakSet} seen  - objects already visited, to survive circular references
+ * @return {any} the value that was passed in
+ */
+function normaliseJSONataResult(value, seen) {
+    if (value === null || typeof value !== 'object') { return value }
+    if (seen.has(value)) { return value }
+    seen.add(value)
+    if (Array.isArray(value)) {
+        for (var i = 0; i < value.length; i++) {
+            normaliseJSONataResult(value[i], seen)
+        }
+        return value
+    }
+    var proto = Object.getPrototypeOf(value)
+    if (proto === null) {
+        Object.setPrototypeOf(value, Object.prototype)
+    } else if (proto !== Object.prototype) {
+        return value
+    }
+    var keys = Object.keys(value)
+    for (var k = 0; k < keys.length; k++) {
+        normaliseJSONataResult(value[keys[k]], seen)
+    }
+    return value
+}
+
 /**
  * Normalise a node type name to camel case.
  *
@@ -824,7 +870,7 @@ function normaliseNodeTypeName(name) {
 function encodeObject(msg,opts) {
     try {
         var debuglength = 1000;
-        if (opts && hasOwnProperty.call(opts, 'maxLength')) {
+        if (opts && Object.hasOwn(opts, 'maxLength')) {
             debuglength = opts.maxLength;
         }
         var msgType = typeof msg.msg;
@@ -837,7 +883,7 @@ function encodeObject(msg,opts) {
                 type: 'error',
                 data: {
                     name: msg.msg.name,
-                    message: hasOwnProperty.call(msg.msg, 'message') ? msg.msg.message : msg.msg.toString(),
+                    message: Object.hasOwn(msg.msg, 'message') ? msg.msg.message : msg.msg.toString(),
                     code: msg.msg.code,
                     cause: cause + "",
                     stack: msg.msg.stack,
@@ -928,7 +974,7 @@ function encodeObject(msg,opts) {
                                 type: 'error',
                                 data: {
                                     name: value.name,
-                                    message: hasOwnProperty.call(value, 'message') ? value.message : value.toString(),
+                                    message: Object.hasOwn(value, 'message') ? value.message : value.toString(),
                                     code,
                                     cause: cause + "",
                                     stack: value.stack,
@@ -1079,7 +1125,7 @@ function encodeObject(msg,opts) {
             type: 'error',
             data: {
                 name: e.name,
-                message: 'encodeObject Error: ' + (hasOwnProperty.call(e, 'message') ? e.message : e.toString()),
+                message: 'encodeObject Error: ' + (Object.hasOwn(e, 'message') ? e.message : e.toString()),
                 stack: e.stack,
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@node-red/util",
-    "version": "4.1.13",
+    "version": "4.1.14",
     "license": "Apache-2.0",
     "repository": {
         "type": "git",
@@ -19,7 +19,7 @@
         "fs-extra": "11.4.0",
         "i18next": "25.8.14",
         "json-stringify-safe": "5.0.1",
-        "jsonata": "2.0.6",
+        "jsonata": "2.2.2",
         "lodash.clonedeep": "^4.5.0",
         "moment": "2.30.1",
         "moment-timezone": "0.5.48"