@tstdl/base 0.93.53 → 0.93.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tstdl/base",
-  "version": "0.93.53",
+  "version": "0.93.55",
   "author": "Patrick Hein",
   "publishConfig": {
     "access": "public"
@@ -134,7 +134,7 @@
     "reflect-metadata": "^0.2",
     "rxjs": "^7.8",
     "ts-pattern": "^5.9",
-    "type-fest": "^5.2"
+    "type-fest": "^5.3"
   },
   "peerDependencies": {
     "@google-cloud/storage": "^7.17",

package/schema/schemas/object.js

@@ -50,7 +50,7 @@ export class ObjectSchema extends Schema {
         let inputKeys = null;
         let inputKeyCount = 0;
         if (requiresInputKeyScan) {
-            inputKeys = Object.keys(value);
+            inputKeys = Object.keys(value); // manual check of __proto__ below
             inputKeyCount = inputKeys.length;
         }
         if (isNotNull(this.minimumPropertiesCount) && (inputKeyCount < this.minimumPropertiesCount)) {
@@ -82,6 +82,9 @@ export class ObjectSchema extends Schema {
                 const keyLength = inputKeys.length;
                 for (let i = 0; i < keyLength; i++) {
                     const key = inputKeys[i];
+                    if (key == '__proto__') {
+                        return { valid: false, error: new SchemaError('Property key "__proto__" is not allowed.', { path: path.add(key), fast: options.fastErrors }) };
+                    }
                     if (this.knownPropertyKeys.has(key)) {
                         continue;
                     }

package/utils/stream/to-readable-stream.js

@@ -3,6 +3,6 @@ export function toReadableStream(value) {
         start(controller) {
             controller.enqueue(value);
             controller.close();
-        }
+        },
     });
 }