protobufjs 8.3.0 → 8.4.1

package/index.d.ts

@@ -340,6 +340,9 @@ export class FieldBase extends ReflectionObject {
      */
     constructor(name: string, id: number, type: string, rule?: (string|{ [k: string]: any }), extend?: (string|{ [k: string]: any }), options?: { [k: string]: any }, comment?: string);
 
+    /** Field rule, if any. */
+    rule?: string;
+
     /** Field type. */
     type: string;
 
@@ -578,7 +581,7 @@ export class Message<T extends object = object> {
      * @param [properties] Properties to set
      * @returns Message instance
      */
-    static create<T extends Message<T>>(this: Constructor<T>, properties?: { [k: string]: any }): Message<T>;
+    static create<T extends Message<T>>(this: Constructor<T>, properties?: { [k: string]: any }): T;
 
     /**
      * Encodes a message of this type.
@@ -1740,7 +1743,7 @@ export class Type extends NamespaceBase {
      * @param [properties] Properties to set
      * @returns Message instance
      */
-    create(properties?: { [k: string]: any }): Message<{}>;
+    create(properties?: { [k: string]: any }): ReflectedMessage;
 
     /**
      * Sets up {@link Type#encode|encode}, {@link Type#decode|decode} and {@link Type#verify|verify}.
@@ -1772,7 +1775,7 @@ export class Type extends NamespaceBase {
      * @throws {Error} If the payload is not a reader or valid buffer
      * @throws {util.ProtocolError<{}>} If required fields are missing
      */
-    decode(reader: (Reader|Uint8Array), length?: number): Message<{}>;
+    decode(reader: (Reader|Uint8Array), length?: number): ReflectedMessage;
 
     /**
      * Decodes a message of this type preceeded by its byte length as a varint.
@@ -1781,7 +1784,7 @@ export class Type extends NamespaceBase {
      * @throws {Error} If the payload is not a reader or valid buffer
      * @throws {util.ProtocolError} If required fields are missing
      */
-    decodeDelimited(reader: (Reader|Uint8Array)): Message<{}>;
+    decodeDelimited(reader: (Reader|Uint8Array)): ReflectedMessage;
 
     /**
      * Verifies that field values are valid and that required fields are present.
@@ -1795,7 +1798,7 @@ export class Type extends NamespaceBase {
      * @param object Plain object to convert
      * @returns Message instance
      */
-    fromObject(object: { [k: string]: any }): Message<{}>;
+    fromObject(object: { [k: string]: any }): ReflectedMessage;
 
     /**
      * Creates a plain object from a message of this type. Also converts values to other types if specified.
@@ -1851,7 +1854,7 @@ export interface IConversionOptions {
 
     /**
      * Long conversion type.
-     * Valid values are `String` and `Number` (the global types).
+     * Valid values are `BigInt`, `String` and `Number` (the global types).
      * Defaults to copy the present value, which is a possibly unsafe number without and a {@link Long} with a long library.
      */
     longs?: Function;
@@ -1984,6 +1987,9 @@ export type Constructor<T> = Function & { new(...params: any[]): T; prototype: T
 /** Properties type. */
 export type Properties<T> = { [P in keyof T]?: T[P] };
 
+/** Dynamically reflected message type. */
+export type ReflectedMessage = Message<{}> & { [k: string]: any };
+
 /**
  * Callback as used by {@link util.asPromise}.
  * @param error Error, if any
@@ -2356,6 +2362,13 @@ export namespace util {
         length(): number;
     }
 
+    /**
+     * Tests if the specified key can affect object prototypes.
+     * @param key Key to test
+     * @returns `true` if the key is unsafe
+     */
+    function isUnsafeProperty(key: string): boolean;
+
     /** Whether running within node or not. */
     let isNode: boolean;
 
@@ -2464,11 +2477,10 @@ export namespace util {
     /**
      * Merges the properties of the source object into the destination object.
      * @param dst Destination object
-     * @param src Source object
-     * @param [ifNotSet=false] Merges only if the key is not already set
+     * @param src Source objects, optionally followed by an `ifNotSet` flag
      * @returns Destination object
      */
-    function merge(dst: { [k: string]: any }, src: { [k: string]: any }, ifNotSet?: boolean): { [k: string]: any };
+    function merge(dst: { [k: string]: any }, ...src: any[]): { [k: string]: any };
 
     /** Schema declaration nesting limit. */
     let nestingLimit: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protobufjs",
-  "version": "8.3.0",
+  "version": "8.4.1",
   "versionScheme": "~",
   "description": "Protocol Buffers for JavaScript & TypeScript.",
   "author": "Daniel Wirtz <dcode+protobufjs@dcode.io>",
@@ -46,7 +46,7 @@
     "make": "npm run lint:sources && npm run build && npm run lint:types && node ./scripts/gentests.js && npm test"
   },
   "dependencies": {
-    "long": "^5.0.0"
+    "long": "^5.3.2"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.0",

package/src/converter.js

@@ -62,14 +62,14 @@ function genValuePartial_fromObject(gen, field, fieldIndex, prop) {
                 ("m%s=d%s|0", prop, prop);
                 break;
             case "uint64":
+            case "fixed64":
                 isUnsigned = true;
                 // eslint-disable-next-line no-fallthrough
             case "int64":
             case "sint64":
-            case "fixed64":
             case "sfixed64": gen
                 ("if(util.Long)")
-                    ("(m%s=util.Long.fromValue(d%s)).unsigned=%j", prop, prop, isUnsigned)
+                    ("m%s=util.Long.fromValue(d%s,%j)", prop, prop, isUnsigned)
                 ("else if(typeof d%s===\"string\")", prop)
                     ("m%s=parseInt(d%s,10)", prop, prop)
                 ("else if(typeof d%s===\"number\")", prop)
@@ -194,7 +194,7 @@ function genValuePartial_toObject(gen, field, fieldIndex, dstProp, srcProp) {
         if (field.resolvedType instanceof Enum) gen
             ("d%s=o.enums===String?(types[%i].values[m%s]===undefined?m%s:types[%i].values[m%s]):m%s", dstProp, fieldIndex, srcProp, srcProp, fieldIndex, srcProp, srcProp);
         else gen
-            ("d%s=types[%i].toObject(m%s,o)", dstProp, fieldIndex, srcProp);
+            ("d%s=types[%i].toObject(m%s,o,q+1)", dstProp, fieldIndex, srcProp);
     } else {
         var isUnsigned = false;
         switch (field.type) {
@@ -203,13 +203,15 @@ function genValuePartial_toObject(gen, field, fieldIndex, dstProp, srcProp) {
             ("d%s=o.json&&!isFinite(m%s)?String(m%s):m%s", dstProp, srcProp, srcProp, srcProp);
                 break;
             case "uint64":
+            case "fixed64":
                 isUnsigned = true;
                 // eslint-disable-next-line no-fallthrough
             case "int64":
             case "sint64":
-            case "fixed64":
             case "sfixed64": gen
-            ("if(typeof m%s===\"number\")", srcProp)
+            ("if(typeof BigInt!==\"undefined\"&&o.longs===BigInt)")
+                ("d%s=typeof m%s===\"number\"?BigInt(m%s):util.Long.fromBits(m%s.low>>>0,m%s.high>>>0,%j).toBigInt()", dstProp, srcProp, srcProp, srcProp, srcProp, isUnsigned)
+            ("else if(typeof m%s===\"number\")", srcProp)
                 ("d%s=o.longs===String?String(m%s):m%s", dstProp, srcProp, srcProp)
             ("else") // Long-like
                 ("d%s=o.longs===String?util.Long.prototype.toString.call(m%s):o.longs===Number?new util.LongBits(m%s.low>>>0,m%s.high>>>0).toNumber(%s):m%s", dstProp, srcProp, srcProp, srcProp, isUnsigned ? "true": "", srcProp);
@@ -236,9 +238,12 @@ converter.toObject = function toObject(mtype) {
     var fields = mtype.fieldsArray.slice().sort(util.compareFieldsById);
     if (!fields.length)
         return util.codegen()("return {}");
-    var gen = util.codegen(["m", "o"], mtype.name + "$toObject")
+    var gen = util.codegen(["m", "o", "q"], mtype.name + "$toObject")
     ("if(!o)")
         ("o={}")
+    ("if(q===undefined)q=0")
+    ("if(q>util.recursionLimit)")
+        ("throw Error(\"max depth exceeded\")")
     ("var d={}");
 
     var repeatedFields = [],
@@ -277,9 +282,9 @@ converter.toObject = function toObject(mtype) {
             else if (field.long) gen
         ("if(util.Long){")
             ("var n=new util.Long(%i,%i,%j)", field.typeDefault.low, field.typeDefault.high, field.typeDefault.unsigned)
-            ("d%s=o.longs===String?n.toString():o.longs===Number?n.toNumber():n", prop)
+            ("d%s=o.longs===String?n.toString():o.longs===Number?n.toNumber():typeof BigInt!==\"undefined\"&&o.longs===BigInt?n.toBigInt():n", prop)
         ("}else")
-            ("d%s=o.longs===String?%j:%i", prop, field.typeDefault.toString(), field.typeDefault.toNumber());
+            ("d%s=o.longs===String?%j:typeof BigInt!==\"undefined\"&&o.longs===BigInt?BigInt(%j):%i", prop, field.typeDefault.toString(), field.typeDefault.toString(), field.typeDefault.toNumber());
             else if (field.bytes) {
                 var arrayDefault = Array.prototype.slice.call(field.typeDefault);
                 gen
@@ -324,7 +329,7 @@ converter.toObject = function toObject(mtype) {
         } else { gen
     ("if(m%s!=null&&m.hasOwnProperty(%j)){", prop, field.name); // !== undefined && !== null
         genValuePartial_toObject(gen, field, /* sorted */ index, prop);
-        if (field.partOf) gen
+        if (field.partOf && !field.partOf.isProto3Optional) gen
         ("if(o.oneofs)")
             ("d%s=%j", util.safeProp(field.partOf.name), field.name);
         }

package/src/decoder.js

@@ -63,7 +63,9 @@ function decoder(mtype) {
             else gen
                 ("k=null");
 
-            if (types.defaults[type] !== undefined) gen
+            if (types.long[type] !== undefined) gen
+                ("v=util.Long?util.Long.fromNumber(0,%j):0", type === "uint64" || type === "fixed64");
+            else if (types.defaults[type] !== undefined) gen
                 ("v=%j", types.defaults[type]);
             else gen
                 ("v=null");

package/src/encoder.js

@@ -16,8 +16,8 @@ var Enum     = require("./enum"),
  */
 function genTypePartial(gen, field, fieldIndex, ref) {
     return field.delimited
-        ? gen("types[%i].encode(%s,w.uint32(%i)).uint32(%i)", fieldIndex, ref, (field.id << 3 | 3) >>> 0, (field.id << 3 | 4) >>> 0)
-        : gen("types[%i].encode(%s,w.uint32(%i).fork()).ldelim()", fieldIndex, ref, (field.id << 3 | 2) >>> 0);
+        ? gen("types[%i].encode(%s,w.uint32(%i),q+1).uint32(%i)", fieldIndex, ref, (field.id << 3 | 3) >>> 0, (field.id << 3 | 4) >>> 0)
+        : gen("types[%i].encode(%s,w.uint32(%i).fork(),q+1).ldelim()", fieldIndex, ref, (field.id << 3 | 2) >>> 0);
 }
 
 /**
@@ -27,9 +27,12 @@ function genTypePartial(gen, field, fieldIndex, ref) {
  */
 function encoder(mtype) {
     /* eslint-disable no-unexpected-multiline, block-scoped-var, no-redeclare */
-    var gen = util.codegen(["m", "w"], mtype.name + "$encode")
+    var gen = util.codegen(["m", "w", "q"], mtype.name + "$encode")
     ("if(!w)")
-        ("w=Writer.create()");
+        ("w=Writer.create()")
+    ("if(q===undefined)q=0")
+    ("if(q>util.recursionLimit)")
+        ("throw Error(\"max depth exceeded\")");
 
     var i, ref;
 
@@ -55,7 +58,7 @@ function encoder(mtype) {
             else gen
             ("w.uint32(%i).fork().uint32(%i).%s(ks[i])", (field.id << 3 | 2) >>> 0, 8 | types.mapKey[field.keyType], field.keyType);
             if (wireType === undefined) gen
-            ("types[%i].encode(%s[ks[i]],w.uint32(18).fork()).ldelim().ldelim()", index, ref); // can't be groups
+            ("types[%i].encode(%s[ks[i]],w.uint32(18).fork(),q+1).ldelim().ldelim()", index, ref); // can't be groups
             else gen
             (".uint32(%i).%s(%s[ks[i]]).ldelim()", 16 | wireType, type, ref);
             gen

package/src/enum.js

@@ -86,8 +86,8 @@ Enum.prototype._resolveFeatures = function _resolveFeatures(edition) {
     ReflectionObject.prototype._resolveFeatures.call(this, edition);
 
     Object.keys(this.values).forEach(key => {
-        var parentFeaturesCopy = Object.assign({}, this._features);
-        this._valuesFeatures[key] = Object.assign(parentFeaturesCopy, this.valuesOptions && this.valuesOptions[key] && this.valuesOptions[key].features);
+        var parentFeaturesCopy = util.merge({}, this._features);
+        this._valuesFeatures[key] = util.merge(parentFeaturesCopy, this.valuesOptions && this.valuesOptions[key] && this.valuesOptions[key].features || {});
     });
 
     return this;

package/src/field.js

@@ -11,7 +11,7 @@ var Enum  = require("./enum"),
 
 var Type; // cyclic
 
-var ruleRe = /^required|optional|repeated$/;
+var ruleRe = /^(?:required|optional|repeated)$/;
 
 /**
  * Constructs a new message field instance. Note that {@link MapField|map fields} have their own class.
@@ -86,9 +86,6 @@ function Field(name, id, type, rule, extend, options, comment) {
      * Field rule, if any.
      * @type {string|undefined}
      */
-    if (rule === "proto3_optional") {
-        rule = "optional";
-    }
     this.rule = rule && rule !== "optional" ? rule : undefined; // toJSON
 
     /**
@@ -330,7 +327,7 @@ Field.prototype.resolve = function resolve() {
 
     // convert to internal data type if necesssary
     if (this.long) {
-        this.typeDefault = util.Long.fromNumber(this.typeDefault, this.type.charAt(0) === "u");
+        this.typeDefault = util.Long.fromNumber(this.typeDefault, this.type === "uint64" || this.type === "fixed64");
 
         /* istanbul ignore else */
         if (Object.freeze)

package/src/index-light.js

@@ -100,5 +100,5 @@ protobuf.util             = require("./util");
 // Set up possibly cyclic reflection dependencies
 protobuf.ReflectionObject._configure(protobuf.Root);
 protobuf.Namespace._configure(protobuf.Type, protobuf.Service, protobuf.Enum);
-protobuf.Root._configure(protobuf.Type);
+protobuf.Root._configure(protobuf.Type, undefined, {});
 protobuf.Field._configure(protobuf.Type);

package/src/message.js

@@ -36,7 +36,7 @@ function Message(properties) {
 /**
  * Creates a new message of this type using the specified properties.
  * @param {Object.<string,*>} [properties] Properties to set
- * @returns {Message<T>} Message instance
+ * @returns {T} Message instance
  * @template T extends Message<T>
  * @this Constructor<T>
  */

package/src/object.js

@@ -213,7 +213,7 @@ ReflectionObject.prototype._resolveFeatures = function _resolveFeatures(edition)
         throw new Error("Unknown edition for " + this.fullName);
     }
 
-    var protoFeatures = Object.assign(this.options ? Object.assign({},  this.options.features) : {},
+    var protoFeatures = util.merge({}, this.options && this.options.features,
         this._inferLegacyProtoFeatures(edition));
 
     if (this._edition) {
@@ -230,19 +230,19 @@ ReflectionObject.prototype._resolveFeatures = function _resolveFeatures(edition)
         } else {
             throw new Error("Unknown edition: " + edition);
         }
-        this._features = Object.assign(defaults, protoFeatures || {});
+        this._features = util.merge(defaults, protoFeatures);
     } else {
         // fields in Oneofs aren't actually children of them, so we have to
         // special-case it
         /* istanbul ignore else */
         if (this.partOf instanceof OneOf) {
-            var lexicalParentFeaturesCopy = Object.assign({}, this.partOf._features);
-            this._features = Object.assign(lexicalParentFeaturesCopy, protoFeatures || {});
+            var lexicalParentFeaturesCopy = util.merge({}, this.partOf._features);
+            this._features = util.merge(lexicalParentFeaturesCopy, protoFeatures);
         } else if (this.declaringField) {
             // Skip feature resolution of sister fields.
         } else if (this.parent) {
-            var parentFeaturesCopy = Object.assign({}, this.parent._features);
-            this._features = Object.assign(parentFeaturesCopy, protoFeatures || {});
+            var parentFeaturesCopy = util.merge({}, this.parent._features);
+            this._features = util.merge(parentFeaturesCopy, protoFeatures);
         } else {
             throw new Error("Unable to find a parent for " + this.fullName);
         }

package/src/parse.js

@@ -482,7 +482,7 @@ function parse(source, root, options) {
         name = applyCase(name);
         skip("=");
 
-        var field = new Field(name, parseId(next()), type, rule, extend);
+        var field = new Field(name, parseId(next()), type, rule === "proto3_optional" ? "optional" : rule, extend);
 
         ifBlock(field, function parseField_block(token) {
 

package/src/root.js

@@ -142,8 +142,12 @@ Root.prototype.load = function load(filename, options, callback) {
     }
 
     // Processes a single file
-    function process(filename, source) {
+    function process(filename, source, depth) {
+        if (depth === undefined)
+            depth = 0;
         try {
+            if (depth > util.recursionLimit)
+                throw Error("max depth exceeded");
             if (util.isString(source) && source.charAt(0) === "{")
                 source = JSON.parse(source);
             if (!util.isString(source))
@@ -156,11 +160,11 @@ Root.prototype.load = function load(filename, options, callback) {
                 if (parsed.imports)
                     for (; i < parsed.imports.length; ++i)
                         if (resolved = getBundledFileName(parsed.imports[i]) || self.resolvePath(filename, parsed.imports[i]))
-                            fetch(resolved);
+                            fetch(resolved, false, depth + 1);
                 if (parsed.weakImports)
                     for (i = 0; i < parsed.weakImports.length; ++i)
                         if (resolved = getBundledFileName(parsed.weakImports[i]) || self.resolvePath(filename, parsed.weakImports[i]))
-                            fetch(resolved, true);
+                            fetch(resolved, true, depth + 1);
             }
         } catch (err) {
             finish(err);
@@ -171,7 +175,9 @@ Root.prototype.load = function load(filename, options, callback) {
     }
 
     // Fetches a single file
-    function fetch(filename, weak) {
+    function fetch(filename, weak, depth) {
+        if (depth === undefined)
+            depth = 0;
         filename = getBundledFileName(filename) || filename;
 
         // Skip if already loaded / attempted
@@ -183,12 +189,12 @@ Root.prototype.load = function load(filename, options, callback) {
         // Shortcut bundled definitions
         if (Object.prototype.hasOwnProperty.call(common, filename)) {
             if (sync) {
-                process(filename, common[filename]);
+                process(filename, common[filename], depth);
             } else {
                 ++queued;
                 setTimeout(function() {
                     --queued;
-                    process(filename, common[filename]);
+                    process(filename, common[filename], depth);
                 });
             }
             return;
@@ -204,7 +210,7 @@ Root.prototype.load = function load(filename, options, callback) {
                     finish(err);
                 return;
             }
-            process(filename, source);
+            process(filename, source, depth);
         } else {
             ++queued;
             self.fetch(filename, function(err, source) {
@@ -221,7 +227,7 @@ Root.prototype.load = function load(filename, options, callback) {
                         finish(null, self);
                     return;
                 }
-                process(filename, source);
+                process(filename, source, depth);
             });
         }
     }

package/src/type.js

@@ -458,7 +458,7 @@ Type.prototype.isReservedName = function isReservedName(name) {
 /**
  * Creates a new message of this type using the specified properties.
  * @param {Object.<string,*>} [properties] Properties to set
- * @returns {Message<{}>} Message instance
+ * @returns {ReflectedMessage} Message instance
  */
 Type.prototype.create = function create(properties) {
     return new this.ctor(properties);
@@ -524,8 +524,8 @@ Type.prototype.setup = function setup() {
  * @param {Writer} [writer] Writer to encode to
  * @returns {Writer} writer
  */
-Type.prototype.encode = function encode_setup(message, writer) {
-    return this.setup().encode(message, writer); // overrides this method
+Type.prototype.encode = function encode_setup(message, writer) { // eslint-disable-line no-unused-vars
+    return this.setup().encode.apply(this, arguments); // overrides this method
 };
 
 /**
@@ -542,7 +542,7 @@ Type.prototype.encodeDelimited = function encodeDelimited(message, writer) {
  * Decodes a message of this type.
  * @param {Reader|Uint8Array} reader Reader or buffer to decode from
  * @param {number} [length] Length of the message, if known beforehand
- * @returns {Message<{}>} Decoded message
+ * @returns {ReflectedMessage} Decoded message
  * @throws {Error} If the payload is not a reader or valid buffer
  * @throws {util.ProtocolError<{}>} If required fields are missing
  */
@@ -553,7 +553,7 @@ Type.prototype.decode = function decode_setup(reader, length) { // eslint-disabl
 /**
  * Decodes a message of this type preceeded by its byte length as a varint.
  * @param {Reader|Uint8Array} reader Reader or buffer to decode from
- * @returns {Message<{}>} Decoded message
+ * @returns {ReflectedMessage} Decoded message
  * @throws {Error} If the payload is not a reader or valid buffer
  * @throws {util.ProtocolError} If required fields are missing
  */
@@ -575,7 +575,7 @@ Type.prototype.verify = function verify_setup(message) { // eslint-disable-line
 /**
  * Creates a new message of this type from a plain object. Also converts values to their respective internal types.
  * @param {Object.<string,*>} object Plain object to convert
- * @returns {Message<{}>} Message instance
+ * @returns {ReflectedMessage} Message instance
  */
 Type.prototype.fromObject = function fromObject(object) { // eslint-disable-line no-unused-vars
     return this.setup().fromObject.apply(this, arguments);
@@ -585,7 +585,7 @@ Type.prototype.fromObject = function fromObject(object) { // eslint-disable-line
  * Conversion options as used by {@link Type#toObject} and {@link Message.toObject}.
  * @interface IConversionOptions
  * @property {Function} [longs] Long conversion type.
- * Valid values are `String` and `Number` (the global types).
+ * Valid values are `BigInt`, `String` and `Number` (the global types).
  * Defaults to copy the present value, which is a possibly unsafe number without and a {@link Long} with a long library.
  * @property {Function} [enums] Enum value conversion type.
  * Only valid value is `String` (the global type).
@@ -606,8 +606,8 @@ Type.prototype.fromObject = function fromObject(object) { // eslint-disable-line
  * @param {IConversionOptions} [options] Conversion options
  * @returns {Object.<string,*>} Plain object
  */
-Type.prototype.toObject = function toObject(message, options) {
-    return this.setup().toObject(message, options);
+Type.prototype.toObject = function toObject(message, options) { // eslint-disable-line no-unused-vars
+    return this.setup().toObject.apply(this, arguments);
 };
 
 /**

package/src/typescript.js

@@ -17,3 +17,9 @@ var Constructor;
  * @typedef {{ [P in keyof T]?: T[P] }} Properties
  */
 var Properties;
+
+/**
+ * Dynamically reflected message type.
+ * @typedef {Message<{}> & { [k: string]: any }} ReflectedMessage
+ */
+var ReflectedMessage;

package/src/util/eventemitter.js

@@ -14,7 +14,7 @@ function EventEmitter() {
      * @type {Object.<string,*>}
      * @private
      */
-    this._listeners = {};
+    this._listeners = Object.create(null);
 }
 
 /**
@@ -48,12 +48,14 @@ EventEmitter.prototype.on = function on(evt, fn, ctx) {
  */
 EventEmitter.prototype.off = function off(evt, fn) {
     if (evt === undefined)
-        this._listeners = {};
+        this._listeners = Object.create(null);
     else {
         if (fn === undefined)
             this._listeners[evt] = [];
         else {
             var listeners = this._listeners[evt];
+            if (!listeners)
+                return this;
             for (var i = 0; i < listeners.length;)
                 if (listeners[i].fn === fn)
                     listeners.splice(i, 1);

package/src/util/minimal.js

@@ -25,6 +25,18 @@ util.pool = require("./pool");
 // utility to work with the low and high bits of a 64 bit value
 util.LongBits = require("./longbits");
 
+/**
+ * Tests if the specified key can affect object prototypes.
+ * @memberof util
+ * @param {string} key Key to test
+ * @returns {boolean} `true` if the key is unsafe
+ */
+function isUnsafeProperty(key) {
+    return key === "__proto__" || key === "prototype" || key === "constructor";
+}
+
+util.isUnsafeProperty = isUnsafeProperty;
+
 /**
  * Whether running within node or not.
  * @memberof util
@@ -259,15 +271,21 @@ util.boolFromKey = function boolFromKey(key) {
  * Merges the properties of the source object into the destination object.
  * @memberof util
  * @param {Object.<string,*>} dst Destination object
- * @param {Object.<string,*>} src Source object
- * @param {boolean} [ifNotSet=false] Merges only if the key is not already set
+ * @param {...(Object.<string,*>|boolean)} src Source objects, optionally followed by an `ifNotSet` flag
  * @returns {Object.<string,*>} Destination object
  */
-function merge(dst, src, ifNotSet) { // used by converters
-    for (var keys = Object.keys(src), i = 0; i < keys.length; ++i)
-        if (dst[keys[i]] === undefined || !ifNotSet)
-            if (keys[i] !== "__proto__")
+function merge(dst) { // used by converters
+    var ifNotSet = typeof arguments[arguments.length - 1] === "boolean",
+        limit = ifNotSet ? arguments.length - 1 : arguments.length;
+    ifNotSet = ifNotSet && arguments[arguments.length - 1];
+    for (var a = 1; a < limit; ++a) {
+        var src = arguments[a];
+        if (!src)
+            continue;
+        for (var keys = Object.keys(src), i = 0; i < keys.length; ++i)
+            if (!isUnsafeProperty(keys[i]) && (dst[keys[i]] === undefined || !ifNotSet))
                 dst[keys[i]] = src[keys[i]];
+    }
     return dst;
 }
 

package/src/util/patterns.js

@@ -5,4 +5,3 @@ var patterns = exports;
 patterns.numberRe    = /^(?![eE])[0-9]*(?:\.[0-9]*)?(?:[eE][+-]?[0-9]+)?$/;
 patterns.typeRefRe   = /^(?:\.?[a-zA-Z_][a-zA-Z_0-9]*)(?:\.[a-zA-Z_][a-zA-Z_0-9]*)*$/;
 patterns.reservedRe  = /^(?:do|if|in|for|let|new|try|var|case|else|enum|eval|false|null|this|true|void|with|break|catch|class|const|super|throw|while|yield|delete|export|import|public|return|static|switch|typeof|default|extends|finally|package|private|continue|debugger|function|arguments|interface|protected|implements|instanceof)$/;
-patterns.unsafePropertyRe = /^(?:__proto__|prototype|constructor)$/;

package/src/util/pool.js

@@ -16,7 +16,7 @@ module.exports = pool;
  * @param {number} start Start offset
  * @param {number} end End offset
  * @returns {Uint8Array} Buffer slice
- * @this {Uint8Array}
+ * @this Uint8Array
  */
 
 /**

package/src/util.js

@@ -16,8 +16,7 @@ util.fetch    = require("./util/fetch");
 util.path     = require("./util/path");
 util.patterns = require("./util/patterns");
 
-var reservedRe = util.patterns.reservedRe,
-    unsafePropertyRe = util.patterns.unsafePropertyRe;
+var reservedRe = util.patterns.reservedRe;
 
 /**
  * Node's fs module if available.
@@ -180,7 +179,7 @@ util.decorateEnum = function decorateEnum(object) {
 util.setProperty = function setProperty(dst, path, value, ifNotSet) {
     function setProp(dst, path, value) {
         var part = path.shift();
-        if (unsafePropertyRe.test(part))
+        if (util.isUnsafeProperty(part))
             return dst;
         if (path.length > 0) {
             dst[part] = setProp(dst[part] || {}, path, value);