decoders 2.9.3 → 2.10.0

package/dist/index.cjs

@@ -574,11 +574,26 @@ function difference(xs, ys) {
 }
 
 // src/objects.ts
+// @__NO_SIDE_EFFECTS__
+function rejectUnsafeKey(decoders) {
+  if (Object.prototype.hasOwnProperty.call(decoders, "__proto__")) {
+    throw new Error(
+      'Unsafe key: "__proto__" cannot be used in an object(), exact(), or inexact() definition'
+    );
+  }
+}
+// @__NO_SIDE_EFFECTS__
+function annotateUnsafeKey(plainObj) {
+  return merge(
+    public_annotateObject(plainObj),
+    /* @__PURE__ */ new Map([["__proto__", public_annotate(plainObj["__proto__"], "Unsafe key")]])
+  );
+}
 var pojo = define(
   (blob, ok2, err2) => isPlainObject(blob) ? ok2(blob) : err2("Must be an object")
 );
 // @__NO_SIDE_EFFECTS__
-function object(decoders) {
+function buildObject(decoders) {
   const knownKeys = new Set(Object.keys(decoders));
   return pojo.chain((plainObj, ok2, err2) => {
     const actualKeys = new Set(Object.keys(plainObj));
@@ -621,36 +636,51 @@ function object(decoders) {
   });
 }
 // @__NO_SIDE_EFFECTS__
+function object(decoders) {
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
+  return /* @__PURE__ */ buildObject(decoders);
+}
+// @__NO_SIDE_EFFECTS__
 function exact(decoders) {
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
   const allowedKeys = new Set(Object.keys(decoders));
-  const checked = pojo.reject((plainObj) => {
+  const checked = pojo.chain((plainObj, ok2, err2) => {
     const actualKeys = new Set(Object.keys(plainObj));
+    if (actualKeys.has("__proto__")) {
+      return err2(/* @__PURE__ */ annotateUnsafeKey(plainObj));
+    }
     const extraKeys = difference(actualKeys, allowedKeys);
-    return extraKeys.size > 0 ? `Unexpected extra keys: ${Array.from(extraKeys).map(quote).join(", ")}` : null;
+    return extraKeys.size > 0 ? err2(`Unexpected extra keys: ${Array.from(extraKeys).map(quote).join(", ")}`) : ok2(plainObj);
   });
-  return checked.pipe(/* @__PURE__ */ object(decoders));
+  return checked.pipe(/* @__PURE__ */ buildObject(decoders));
 }
 // @__NO_SIDE_EFFECTS__
 function inexact(decoders) {
-  return pojo.pipe((plainObj) => {
-    const allkeys = new Set(Object.keys(plainObj));
-    return (/* @__PURE__ */ object(decoders)).transform((safepart) => {
-      const safekeys = new Set(Object.keys(decoders));
-      for (const k of safekeys) allkeys.add(k);
-      const rv = {};
-      for (const k of allkeys) {
-        if (safekeys.has(k)) {
-          const value = safepart[k];
-          if (value !== void 0) {
-            rv[k] = value;
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
+  return pojo.chain(
+    (plainObj, _ok, err2) => {
+      const allkeys = new Set(Object.keys(plainObj));
+      if (allkeys.has("__proto__")) {
+        return err2(/* @__PURE__ */ annotateUnsafeKey(plainObj));
+      }
+      return (/* @__PURE__ */ buildObject(decoders)).transform((safepart) => {
+        const safekeys = new Set(Object.keys(decoders));
+        for (const k of safekeys) allkeys.add(k);
+        const rv = {};
+        for (const k of allkeys) {
+          if (safekeys.has(k)) {
+            const value = safepart[k];
+            if (value !== void 0) {
+              rv[k] = value;
+            }
+          } else {
+            rv[k] = plainObj[k];
           }
-        } else {
-          rv[k] = plainObj[k];
         }
-      }
-      return rv;
-    });
-  });
+        return rv;
+      });
+    }
+  );
 }
 
 // src/unions.ts
@@ -785,6 +815,11 @@ function record(fst, snd) {
     const errors = /* @__PURE__ */ new Map();
     for (const key of Object.keys(input)) {
       const value = input[key];
+      if (key === "__proto__") {
+        errors.set(key, public_annotate(value, "Unsafe key"));
+        rv = {};
+        continue;
+      }
       const keyResult = _optionalChain([keyDecoder, 'optionalAccess', _4 => _4.decode, 'call', _5 => _5(key)]);
       if (_optionalChain([keyResult, 'optionalAccess', _6 => _6.ok]) === false) {
         return err2(
@@ -819,7 +854,7 @@ function mapping(decoder) {
 }
 
 // src/strings.ts
-var url_re = /^([A-Za-z]{2,12}(?:[+][A-Za-z]{2,12})?):\/\/(?:([^@:]*:?(?:[^@]+)?)@)?(?:([A-Za-z0-9.-]+)(?::([0-9]{2,5}))?)(\/(?:[-+~%/.,!$&'()*:;=@\w]*)?(?:\?[-+~%/.,!$&'()*:;=@?\w]*)?)?(?:#[^\s#]*)?$/;
+var url_re = /^[A-Za-z]{2,12}(?:[+][A-Za-z]{2,12})?:\/\/(?:[^@]*@)?[A-Za-z0-9.-]+(?::[0-9]{2,5})?(?:\/[-+~%/.,!$&'()*:;=@\w]*(?:\?[-+~%/.,!$&'()*:;=@?\w]*)?)?(?:#[^\s#]*)?$/;
 var string = define(
   (blob, ok2, err2) => isString(blob) ? ok2(blob) : err2("Must be string")
 );
@@ -844,7 +879,7 @@ function endsWith(suffix) {
 }
 var email = /* @__PURE__ */ regex(
   // The almost perfect email regex, taken from https://emailregex.com/
-  /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/,
+  /^(?:[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*|".+")@(?:\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}]|(?:[a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,})$/,
   "Must be email"
 );
 var urlString = /* @__PURE__ */ regex(url_re, "Must be URL");

package/dist/index.d.cts

@@ -550,10 +550,6 @@ type ObjectDecoderType<Ds extends Record<string, Decoder<unknown>>> = UndefinedT
  * values further.
  */
 declare const pojo: Decoder<Record<string, unknown>>;
-/**
- * Accepts objects with fields matching the given decoders. Extra fields that
- * exist on the input object are ignored and will not be returned.
- */
 declare function object(decoders: Record<any, never>): Decoder<Record<string, never>>;
 declare function object<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds): Decoder<ObjectDecoderType<Ds>>;
 /**
@@ -565,6 +561,10 @@ declare function exact<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds
 /**
  * Like `object()`, but will pass through any extra fields on the input object
  * unvalidated that will thus be of `unknown` type statically.
+ *
+ * A `__proto__` key is the one exception: it cannot be passed through without
+ * reassigning the prototype of the returned object, so inputs containing one
+ * are rejected.
  */
 declare function inexact(decoders: Record<any, never>): Decoder<Record<string, unknown>>;
 declare function inexact<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds): Decoder<ObjectDecoderType<Ds> & Record<string, unknown>>;

package/dist/index.d.ts

@@ -550,10 +550,6 @@ type ObjectDecoderType<Ds extends Record<string, Decoder<unknown>>> = UndefinedT
  * values further.
  */
 declare const pojo: Decoder<Record<string, unknown>>;
-/**
- * Accepts objects with fields matching the given decoders. Extra fields that
- * exist on the input object are ignored and will not be returned.
- */
 declare function object(decoders: Record<any, never>): Decoder<Record<string, never>>;
 declare function object<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds): Decoder<ObjectDecoderType<Ds>>;
 /**
@@ -565,6 +561,10 @@ declare function exact<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds
 /**
  * Like `object()`, but will pass through any extra fields on the input object
  * unvalidated that will thus be of `unknown` type statically.
+ *
+ * A `__proto__` key is the one exception: it cannot be passed through without
+ * reassigning the prototype of the returned object, so inputs containing one
+ * are rejected.
  */
 declare function inexact(decoders: Record<any, never>): Decoder<Record<string, unknown>>;
 declare function inexact<Ds extends Record<string, Decoder<unknown>>>(decoders: Ds): Decoder<ObjectDecoderType<Ds> & Record<string, unknown>>;

package/dist/index.js

@@ -574,11 +574,26 @@ function difference(xs, ys) {
 }
 
 // src/objects.ts
+// @__NO_SIDE_EFFECTS__
+function rejectUnsafeKey(decoders) {
+  if (Object.prototype.hasOwnProperty.call(decoders, "__proto__")) {
+    throw new Error(
+      'Unsafe key: "__proto__" cannot be used in an object(), exact(), or inexact() definition'
+    );
+  }
+}
+// @__NO_SIDE_EFFECTS__
+function annotateUnsafeKey(plainObj) {
+  return merge(
+    public_annotateObject(plainObj),
+    /* @__PURE__ */ new Map([["__proto__", public_annotate(plainObj["__proto__"], "Unsafe key")]])
+  );
+}
 var pojo = define(
   (blob, ok2, err2) => isPlainObject(blob) ? ok2(blob) : err2("Must be an object")
 );
 // @__NO_SIDE_EFFECTS__
-function object(decoders) {
+function buildObject(decoders) {
   const knownKeys = new Set(Object.keys(decoders));
   return pojo.chain((plainObj, ok2, err2) => {
     const actualKeys = new Set(Object.keys(plainObj));
@@ -621,36 +636,51 @@ function object(decoders) {
   });
 }
 // @__NO_SIDE_EFFECTS__
+function object(decoders) {
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
+  return /* @__PURE__ */ buildObject(decoders);
+}
+// @__NO_SIDE_EFFECTS__
 function exact(decoders) {
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
   const allowedKeys = new Set(Object.keys(decoders));
-  const checked = pojo.reject((plainObj) => {
+  const checked = pojo.chain((plainObj, ok2, err2) => {
     const actualKeys = new Set(Object.keys(plainObj));
+    if (actualKeys.has("__proto__")) {
+      return err2(/* @__PURE__ */ annotateUnsafeKey(plainObj));
+    }
     const extraKeys = difference(actualKeys, allowedKeys);
-    return extraKeys.size > 0 ? `Unexpected extra keys: ${Array.from(extraKeys).map(quote).join(", ")}` : null;
+    return extraKeys.size > 0 ? err2(`Unexpected extra keys: ${Array.from(extraKeys).map(quote).join(", ")}`) : ok2(plainObj);
   });
-  return checked.pipe(/* @__PURE__ */ object(decoders));
+  return checked.pipe(/* @__PURE__ */ buildObject(decoders));
 }
 // @__NO_SIDE_EFFECTS__
 function inexact(decoders) {
-  return pojo.pipe((plainObj) => {
-    const allkeys = new Set(Object.keys(plainObj));
-    return (/* @__PURE__ */ object(decoders)).transform((safepart) => {
-      const safekeys = new Set(Object.keys(decoders));
-      for (const k of safekeys) allkeys.add(k);
-      const rv = {};
-      for (const k of allkeys) {
-        if (safekeys.has(k)) {
-          const value = safepart[k];
-          if (value !== void 0) {
-            rv[k] = value;
+  /* @__PURE__ */ rejectUnsafeKey(decoders);
+  return pojo.chain(
+    (plainObj, _ok, err2) => {
+      const allkeys = new Set(Object.keys(plainObj));
+      if (allkeys.has("__proto__")) {
+        return err2(/* @__PURE__ */ annotateUnsafeKey(plainObj));
+      }
+      return (/* @__PURE__ */ buildObject(decoders)).transform((safepart) => {
+        const safekeys = new Set(Object.keys(decoders));
+        for (const k of safekeys) allkeys.add(k);
+        const rv = {};
+        for (const k of allkeys) {
+          if (safekeys.has(k)) {
+            const value = safepart[k];
+            if (value !== void 0) {
+              rv[k] = value;
+            }
+          } else {
+            rv[k] = plainObj[k];
           }
-        } else {
-          rv[k] = plainObj[k];
         }
-      }
-      return rv;
-    });
-  });
+        return rv;
+      });
+    }
+  );
 }
 
 // src/unions.ts
@@ -785,6 +815,11 @@ function record(fst, snd) {
     const errors = /* @__PURE__ */ new Map();
     for (const key of Object.keys(input)) {
       const value = input[key];
+      if (key === "__proto__") {
+        errors.set(key, public_annotate(value, "Unsafe key"));
+        rv = {};
+        continue;
+      }
       const keyResult = keyDecoder?.decode(key);
       if (keyResult?.ok === false) {
         return err2(
@@ -819,7 +854,7 @@ function mapping(decoder) {
 }
 
 // src/strings.ts
-var url_re = /^([A-Za-z]{2,12}(?:[+][A-Za-z]{2,12})?):\/\/(?:([^@:]*:?(?:[^@]+)?)@)?(?:([A-Za-z0-9.-]+)(?::([0-9]{2,5}))?)(\/(?:[-+~%/.,!$&'()*:;=@\w]*)?(?:\?[-+~%/.,!$&'()*:;=@?\w]*)?)?(?:#[^\s#]*)?$/;
+var url_re = /^[A-Za-z]{2,12}(?:[+][A-Za-z]{2,12})?:\/\/(?:[^@]*@)?[A-Za-z0-9.-]+(?::[0-9]{2,5})?(?:\/[-+~%/.,!$&'()*:;=@\w]*(?:\?[-+~%/.,!$&'()*:;=@?\w]*)?)?(?:#[^\s#]*)?$/;
 var string = define(
   (blob, ok2, err2) => isString(blob) ? ok2(blob) : err2("Must be string")
 );
@@ -844,7 +879,7 @@ function endsWith(suffix) {
 }
 var email = /* @__PURE__ */ regex(
   // The almost perfect email regex, taken from https://emailregex.com/
-  /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/,
+  /^(?:[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*|".+")@(?:\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}]|(?:[a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,})$/,
   "Must be email"
 );
 var urlString = /* @__PURE__ */ regex(url_re, "Must be URL");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decoders",
-  "version": "2.9.3",
+  "version": "2.10.0",
   "description": "Elegant and battle-tested validation library for type-safe input data for TypeScript",
   "license": "MIT",
   "repository": {
@@ -62,22 +62,22 @@
     "verify"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "^0.18.2",
-    "@release-it/keep-a-changelog": "^7.0.1",
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@release-it/keep-a-changelog": "^8.0.1",
     "@standard-schema/spec": "^1.1.0",
-    "@vitest/coverage-istanbul": "^4.1.3",
-    "fast-check": "^4.6.0",
-    "itertools": "^2.6.0",
-    "oxlint": "^1.59.0",
-    "pkg-pr-new": "^0.0.66",
-    "prettier": "^3.8.1",
-    "publint": "^0.3.18",
-    "release-it": "^19.2.4",
-    "ts-morph": "^27.0.2",
+    "@vitest/coverage-istanbul": "^4.1.11",
+    "fast-check": "^4.10.0",
+    "itertools": "^2.7.1",
+    "oxlint": "^1.83.0",
+    "pkg-pr-new": "^0.0.88",
+    "prettier": "^3.9.6",
+    "publint": "^0.3.24",
+    "release-it": "^21.0.3",
+    "ts-morph": "^28.0.0",
     "tsd": "^0.33.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.3"
+    "vitest": "^4.1.11"
   },
   "githubUrl": "https://github.com/nvie/decoders",
   "sideEffects": false