@react-querybuilder/core 8.14.1 → 8.14.3-alpha.0

package/dist/cjs/react-querybuilder_core.cjs.development.d.ts

@@ -3724,6 +3724,11 @@ declare const objectKeys: <Type extends object>(value: Type) => Array<ObjectKeys
 * [Original source](https://github.com/sindresorhus/ts-extras/blob/44f57392c5f027268330771996c4fdf9260b22d6/source/object-entries.ts)
 */
 declare const objectEntries: <Type extends Record<PropertyKey, unknown>>(value: Type) => Array<[ObjectKeys<Type>, Type[ObjectKeys<Type>]]>;
+/**
+* Returns `true` if the key could cause prototype pollution when used
+* as a property name in bracket-notation assignment.
+*/
+declare const isUnsafeKey: (key: unknown) => boolean;
 //#endregion
 //#region src/utils/optGroupUtils.d.ts
 /**
@@ -4363,5 +4368,5 @@ declare function transformQuery(query: RuleGroupType, options?: TransformQueryOp
 */
 declare function transformQuery(query: RuleGroupTypeIC, options?: TransformQueryOptions<RuleGroupTypeIC>): any;
 //#endregion
-export { AccessibleDescriptionGenerator, ActionElementEventHandler, AddMethod, AddOptions, Arity, BaseFullOption, BaseOption, BaseOptionMap, BaseTranslation, BaseTranslationWithLabel, BaseTranslationWithPlaceholders, BaseTranslations, BaseTranslationsFull, Classname, Classnames, Combinator, CombinatorByValue, CommonRuleAndGroupProperties, CommonRuleSubComponentProps, ConstituentWordOrder, ConstituentWordOrderString, DefaultCombinator, DefaultCombinatorExtended, DefaultCombinatorName, DefaultCombinatorNameExtended, DefaultCombinators, DefaultCombinatorsExtended, DefaultMatchModes, DefaultOperator, DefaultOperatorName, DefaultOperators, DefaultRuleGroupArray, DefaultRuleGroupICArray, DefaultRuleGroupType, DefaultRuleGroupTypeAny, DefaultRuleGroupTypeIC, DefaultRuleOrGroupArray, DefaultRuleType, DndDropTargetType, DragCollection, DraggedItem, DropCollection, DropEffect, DropResult, ExportFormat, ExportObjectFormats, ExportOperatorMap, Field, FieldByValue, FindPathReturnType, FlexibleOption, FlexibleOptionGroup, FlexibleOptionList, FlexibleOptionListProp, FormatQueryFinalOptions, FormatQueryOptions, FormatQueryValidateRule, FullCombinator, FullField, FullOperator, FullOption, FullOptionList, FullOptionMap, FullOptionRecord, GenericizeRuleGroupType, GetOptionIdentifierType, GetOptionType, GetRuleGroupType, GetRuleTypeFromGroupWithFieldAndOperator, GroupMethod, GroupOptions, GroupVariantCondition, InputType, InsertMethod, InsertOptions, type JsonLogicAll, type JsonLogicAnd, type JsonLogicDoubleNegation, type JsonLogicEqual, type JsonLogicGreaterThan, type JsonLogicGreaterThanOrEqual, type JsonLogicInArray, type JsonLogicInString, type JsonLogicLessThan, type JsonLogicLessThanOrEqual, type JsonLogicNegation, type JsonLogicNone, type JsonLogicNotEqual, type JsonLogicOr, type JsonLogicReservedOperations, type JsonLogicRulesLogic, type JsonLogicSome, type JsonLogicStrictEqual, type JsonLogicStrictNotEqual, type JsonLogicVar, LogType, MatchConfig, MatchMode, MatchModeOptions, MoveMethod, MoveOptions, NLTranslationKey, NLTranslations, NameLabelPair, Operator, OperatorByValue, Option, OptionGroup, OptionList, ParameterizedNamedSQL, ParameterizedSQL, ParseNumberMethod, ParseNumberOptions, ParseNumbersPropConfig, Path, Placeholder, PrepareOptionListParams, PreparedOptionList, PreparerOptions, QueryActions, QueryBuilderFlags, QueryValidator, RQBJsonLogic, RQBJsonLogicEndsWith, RQBJsonLogicStartsWith, RQBJsonLogicVar, RegenerateIdOptions, RemoveMethod, RemoveNullability, RuleGroupArray, RuleGroupICArray, RuleGroupProcessor, RuleGroupType, RuleGroupTypeAny, RuleGroupTypeIC, RuleOrGroupArray, RuleProcessor, RuleType, RuleValidator, SQLPreset, StringUnionToFlexibleOptionArray, StringUnionToFullOptionArray, TestID, ToFlexibleOption, ToFullOption, TransformQueryOptions, UpdateMethod, UpdateOptions, UpdateableProperties, ValidationMap, ValidationResult, ValueChangeEventHandler, ValueEditorType, ValueOption, ValueProcessor, ValueProcessorByRule, ValueProcessorLegacy, ValueProcessorOptions, ValueSource, ValueSourceFlexibleOptions, ValueSourceFullOptions, ValueSources, WithRequired, WithUnknownIndex, add, addInPlace, bigIntJsonParseReviver, bigIntJsonStringifyReplacer, celCombinatorMap, clsx, convertFromIC, convertQuery, convertToIC, defaultCELValueProcessor, defaultCombinatorLabelMap, defaultCombinators, defaultCombinatorsExtended, defaultControlClassnames, defaultExportOperatorMap, defaultJoinChar, defaultMatchModes, defaultMongoDBValueProcessor, defaultNLTranslations, defaultOperatorLabelMap, defaultOperatorNegationMap, defaultOperatorProcessorNL, defaultOperatorProcessorSQL, defaultOperators, defaultPlaceholderFieldGroupLabel, defaultPlaceholderFieldLabel, defaultPlaceholderFieldName, defaultPlaceholderLabel, defaultPlaceholderName, defaultPlaceholderOperatorGroupLabel, defaultPlaceholderOperatorLabel, defaultPlaceholderOperatorName, defaultPlaceholderValueGroupLabel, defaultPlaceholderValueLabel, defaultPlaceholderValueName, defaultRuleGroupProcessorCEL, defaultRuleGroupProcessorDrizzle, defaultRuleGroupProcessorElasticSearch, defaultRuleGroupProcessorJSONata, defaultRuleGroupProcessorJsonLogic, defaultRuleGroupProcessorLDAP, defaultRuleGroupProcessorMongoDB, defaultRuleGroupProcessorMongoDBQuery, defaultRuleGroupProcessorNL, defaultRuleGroupProcessorParameterized, defaultRuleGroupProcessorPrisma, defaultRuleGroupProcessorSQL, defaultRuleGroupProcessorSequelize, defaultRuleGroupProcessorSpEL, defaultRuleProcessorCEL, defaultRuleProcessorDrizzle, defaultRuleProcessorElasticSearch, defaultRuleProcessorJSONata, defaultRuleProcessorJsonLogic, defaultRuleProcessorLDAP, defaultRuleProcessorMongoDB, defaultRuleProcessorMongoDBQuery, defaultRuleProcessorNL, defaultRuleProcessorParameterized, defaultRuleProcessorPrisma, defaultRuleProcessorSQL, defaultRuleProcessorSequelize, defaultRuleProcessorSpEL, defaultSpELValueProcessor, defaultTranslations, defaultValidator, defaultValueProcessor, defaultValueProcessorByRule, defaultValueProcessorCELByRule, defaultValueProcessorMongoDBByRule, defaultValueProcessorNL, defaultValueProcessorSpELByRule, filterFieldsByComparator, findID, findPath, formatQuery, formatQueryOptionPresets, generateAccessibleDescription, generateID, getCommonAncestorPath, getFirstOption, getMatchModesUtil, getNLTranslataion, getOption, getParentPath, getParseNumberMethod, getPathOfID, getQuoteFieldNamesWithArray, getQuotedFieldName, getValidationClassNames, getValueSourcesUtil, group, groupInPlace, groupInvalidReasons, insert, insertInPlace, isAncestor, isFlexibleOptionArray, isFlexibleOptionGroupArray, isFullOptionArray, isFullOptionGroupArray, isOptionGroupArray, isPojo, isRuleGroup, isRuleGroupType, isRuleGroupTypeIC, isRuleOrGroupValid, isRuleType, isValidValue, isValidationResult, isValueProcessorLegacy, joinWith, jsonLogicAdditionalOperators, lc, mapSQLOperator, mergeAnyTranslation, mergeAnyTranslations, mergeClassnames, mongoDbFallback, mongoOperators, move, moveInPlace, normalizeConstituentWordOrder, nullFreeArray, nullOrUndefinedOrEmpty, numericRegex, numerifyValues, objectEntries, objectKeys, parseNumber, pathIsDisabled, pathsAreEqual, preferAnyProp, preferFlagProps, preferProp, prepareOptionList, prepareRule, prepareRuleGroup, prepareRuleOrGroup, prismaFallback, prismaOperators, processMatchMode, queryBuilderFlagDefaults, regenerateID, regenerateIDs, remove, removeInPlace, rootPath, shouldRenderAsNumber, splitBy, sqlDialectPresets, standardClassnames, toArray, toFlatOptionArray, toFullOption, toFullOptionList, toFullOptionMap, transformQuery, trimIfString, uniqByIdentifier, uniqByName, uniqOptGroups, uniqOptList, update, updateInPlace };
+export { AccessibleDescriptionGenerator, ActionElementEventHandler, AddMethod, AddOptions, Arity, BaseFullOption, BaseOption, BaseOptionMap, BaseTranslation, BaseTranslationWithLabel, BaseTranslationWithPlaceholders, BaseTranslations, BaseTranslationsFull, Classname, Classnames, Combinator, CombinatorByValue, CommonRuleAndGroupProperties, CommonRuleSubComponentProps, ConstituentWordOrder, ConstituentWordOrderString, DefaultCombinator, DefaultCombinatorExtended, DefaultCombinatorName, DefaultCombinatorNameExtended, DefaultCombinators, DefaultCombinatorsExtended, DefaultMatchModes, DefaultOperator, DefaultOperatorName, DefaultOperators, DefaultRuleGroupArray, DefaultRuleGroupICArray, DefaultRuleGroupType, DefaultRuleGroupTypeAny, DefaultRuleGroupTypeIC, DefaultRuleOrGroupArray, DefaultRuleType, DndDropTargetType, DragCollection, DraggedItem, DropCollection, DropEffect, DropResult, ExportFormat, ExportObjectFormats, ExportOperatorMap, Field, FieldByValue, FindPathReturnType, FlexibleOption, FlexibleOptionGroup, FlexibleOptionList, FlexibleOptionListProp, FormatQueryFinalOptions, FormatQueryOptions, FormatQueryValidateRule, FullCombinator, FullField, FullOperator, FullOption, FullOptionList, FullOptionMap, FullOptionRecord, GenericizeRuleGroupType, GetOptionIdentifierType, GetOptionType, GetRuleGroupType, GetRuleTypeFromGroupWithFieldAndOperator, GroupMethod, GroupOptions, GroupVariantCondition, InputType, InsertMethod, InsertOptions, type JsonLogicAll, type JsonLogicAnd, type JsonLogicDoubleNegation, type JsonLogicEqual, type JsonLogicGreaterThan, type JsonLogicGreaterThanOrEqual, type JsonLogicInArray, type JsonLogicInString, type JsonLogicLessThan, type JsonLogicLessThanOrEqual, type JsonLogicNegation, type JsonLogicNone, type JsonLogicNotEqual, type JsonLogicOr, type JsonLogicReservedOperations, type JsonLogicRulesLogic, type JsonLogicSome, type JsonLogicStrictEqual, type JsonLogicStrictNotEqual, type JsonLogicVar, LogType, MatchConfig, MatchMode, MatchModeOptions, MoveMethod, MoveOptions, NLTranslationKey, NLTranslations, NameLabelPair, Operator, OperatorByValue, Option, OptionGroup, OptionList, ParameterizedNamedSQL, ParameterizedSQL, ParseNumberMethod, ParseNumberOptions, ParseNumbersPropConfig, Path, Placeholder, PrepareOptionListParams, PreparedOptionList, PreparerOptions, QueryActions, QueryBuilderFlags, QueryValidator, RQBJsonLogic, RQBJsonLogicEndsWith, RQBJsonLogicStartsWith, RQBJsonLogicVar, RegenerateIdOptions, RemoveMethod, RemoveNullability, RuleGroupArray, RuleGroupICArray, RuleGroupProcessor, RuleGroupType, RuleGroupTypeAny, RuleGroupTypeIC, RuleOrGroupArray, RuleProcessor, RuleType, RuleValidator, SQLPreset, StringUnionToFlexibleOptionArray, StringUnionToFullOptionArray, TestID, ToFlexibleOption, ToFullOption, TransformQueryOptions, UpdateMethod, UpdateOptions, UpdateableProperties, ValidationMap, ValidationResult, ValueChangeEventHandler, ValueEditorType, ValueOption, ValueProcessor, ValueProcessorByRule, ValueProcessorLegacy, ValueProcessorOptions, ValueSource, ValueSourceFlexibleOptions, ValueSourceFullOptions, ValueSources, WithRequired, WithUnknownIndex, add, addInPlace, bigIntJsonParseReviver, bigIntJsonStringifyReplacer, celCombinatorMap, clsx, convertFromIC, convertQuery, convertToIC, defaultCELValueProcessor, defaultCombinatorLabelMap, defaultCombinators, defaultCombinatorsExtended, defaultControlClassnames, defaultExportOperatorMap, defaultJoinChar, defaultMatchModes, defaultMongoDBValueProcessor, defaultNLTranslations, defaultOperatorLabelMap, defaultOperatorNegationMap, defaultOperatorProcessorNL, defaultOperatorProcessorSQL, defaultOperators, defaultPlaceholderFieldGroupLabel, defaultPlaceholderFieldLabel, defaultPlaceholderFieldName, defaultPlaceholderLabel, defaultPlaceholderName, defaultPlaceholderOperatorGroupLabel, defaultPlaceholderOperatorLabel, defaultPlaceholderOperatorName, defaultPlaceholderValueGroupLabel, defaultPlaceholderValueLabel, defaultPlaceholderValueName, defaultRuleGroupProcessorCEL, defaultRuleGroupProcessorDrizzle, defaultRuleGroupProcessorElasticSearch, defaultRuleGroupProcessorJSONata, defaultRuleGroupProcessorJsonLogic, defaultRuleGroupProcessorLDAP, defaultRuleGroupProcessorMongoDB, defaultRuleGroupProcessorMongoDBQuery, defaultRuleGroupProcessorNL, defaultRuleGroupProcessorParameterized, defaultRuleGroupProcessorPrisma, defaultRuleGroupProcessorSQL, defaultRuleGroupProcessorSequelize, defaultRuleGroupProcessorSpEL, defaultRuleProcessorCEL, defaultRuleProcessorDrizzle, defaultRuleProcessorElasticSearch, defaultRuleProcessorJSONata, defaultRuleProcessorJsonLogic, defaultRuleProcessorLDAP, defaultRuleProcessorMongoDB, defaultRuleProcessorMongoDBQuery, defaultRuleProcessorNL, defaultRuleProcessorParameterized, defaultRuleProcessorPrisma, defaultRuleProcessorSQL, defaultRuleProcessorSequelize, defaultRuleProcessorSpEL, defaultSpELValueProcessor, defaultTranslations, defaultValidator, defaultValueProcessor, defaultValueProcessorByRule, defaultValueProcessorCELByRule, defaultValueProcessorMongoDBByRule, defaultValueProcessorNL, defaultValueProcessorSpELByRule, filterFieldsByComparator, findID, findPath, formatQuery, formatQueryOptionPresets, generateAccessibleDescription, generateID, getCommonAncestorPath, getFirstOption, getMatchModesUtil, getNLTranslataion, getOption, getParentPath, getParseNumberMethod, getPathOfID, getQuoteFieldNamesWithArray, getQuotedFieldName, getValidationClassNames, getValueSourcesUtil, group, groupInPlace, groupInvalidReasons, insert, insertInPlace, isAncestor, isFlexibleOptionArray, isFlexibleOptionGroupArray, isFullOptionArray, isFullOptionGroupArray, isOptionGroupArray, isPojo, isRuleGroup, isRuleGroupType, isRuleGroupTypeIC, isRuleOrGroupValid, isRuleType, isUnsafeKey, isValidValue, isValidationResult, isValueProcessorLegacy, joinWith, jsonLogicAdditionalOperators, lc, mapSQLOperator, mergeAnyTranslation, mergeAnyTranslations, mergeClassnames, mongoDbFallback, mongoOperators, move, moveInPlace, normalizeConstituentWordOrder, nullFreeArray, nullOrUndefinedOrEmpty, numericRegex, numerifyValues, objectEntries, objectKeys, parseNumber, pathIsDisabled, pathsAreEqual, preferAnyProp, preferFlagProps, preferProp, prepareOptionList, prepareRule, prepareRuleGroup, prepareRuleOrGroup, prismaFallback, prismaOperators, processMatchMode, queryBuilderFlagDefaults, regenerateID, regenerateIDs, remove, removeInPlace, rootPath, shouldRenderAsNumber, splitBy, sqlDialectPresets, standardClassnames, toArray, toFlatOptionArray, toFullOption, toFullOptionList, toFullOptionMap, transformQuery, trimIfString, uniqByIdentifier, uniqByName, uniqOptGroups, uniqOptList, update, updateInPlace };
 //# sourceMappingURL=react-querybuilder_core.cjs.development.d.ts.map

package/dist/cjs/react-querybuilder_core.cjs.development.js

@@ -821,6 +821,11 @@ const objectKeys = Object.keys;
 * [Original source](https://github.com/sindresorhus/ts-extras/blob/44f57392c5f027268330771996c4fdf9260b22d6/source/object-entries.ts)
 */
 const objectEntries = Object.entries;
+/**
+* Returns `true` if the key could cause prototype pollution when used
+* as a property name in bracket-notation assignment.
+*/
+const isUnsafeKey = (key) => key === "__proto__" || key === "constructor" || key === "prototype";
 //#endregion
 //#region src/utils/optGroupUtils.ts
 const isOptionWithName = (opt) => isPojo(opt) && "name" in opt && typeof opt.name === "string";
@@ -1093,10 +1098,11 @@ const parseNumber = (val, { parseNumbers, bigIntOnOverflow } = {}) => {
 const remapProperties = (obj, propertyMap, deleteRemappedProperties) => {
 	const result = {};
 	for (const key in obj) {
+		if (isUnsafeKey(key)) continue;
 		const mappedKey = propertyMap[key];
 		if (mappedKey === false) continue;
 		if (mappedKey && key !== mappedKey) {
-			result[mappedKey] = obj[key];
+			if (!isUnsafeKey(mappedKey)) result[mappedKey] = obj[key];
 			if (!deleteRemappedProperties) result[key] = obj[key];
 		} else result[key] = obj[key];
 	}
@@ -3828,15 +3834,19 @@ const mergeAnyTranslations = (base, ...otherTranslations) => {
 	const result = { ...base };
 	for (const translations of otherTranslations)
  // istanbul ignore else
-	if (translations) for (const key of objectKeys(translations)) if (result[key]) result[key] = {
-		...result[key],
-		...translations[key]
-	};
-	else result[key] = { ...translations[key] };
+	if (translations) for (const key of objectKeys(translations)) {
+		if (isUnsafeKey(key)) continue;
+		if (result[key]) result[key] = {
+			...result[key],
+			...translations[key]
+		};
+		else result[key] = { ...translations[key] };
+	}
 	return result;
 };
 const mergeAnyTranslation = (el, keyPropContextMap, defaults) => {
-	const finalKeys = objectEntries(keyPropContextMap).map(([key, [pT, cT]]) => [key, pT ?? cT ?? defaults?.[el]?.[key]]).filter((k) => !!k[1]);
+	if (isUnsafeKey(el)) return void 0;
+	const finalKeys = objectEntries(keyPropContextMap).map(([key, [pT, cT]]) => [key, pT ?? cT ?? defaults?.[el]?.[key]]).filter((k) => !isUnsafeKey(k[0]) && !!k[1]);
 	if (finalKeys.length > 0 || defaults) {
 		const defaultProperties = defaults?.[el] ?? {};
 		const finalObject = Object.assign({}, defaultProperties, Object.fromEntries(finalKeys));
@@ -4388,6 +4398,7 @@ exports.isRuleGroupType = isRuleGroupType;
 exports.isRuleGroupTypeIC = isRuleGroupTypeIC;
 exports.isRuleOrGroupValid = isRuleOrGroupValid;
 exports.isRuleType = isRuleType;
+exports.isUnsafeKey = isUnsafeKey;
 exports.isValidValue = isValidValue;
 exports.isValidationResult = isValidationResult;
 exports.isValueProcessorLegacy = isValueProcessorLegacy;