set-object-value 0.0.3 → 0.0.8

package/build/cjs/src/__tests__/IndexTest.js

@@ -0,0 +1,80 @@
+"use strict";
+
+var _interopRequireWildcard = require("reshow-runtime/helpers/interopRequireWildcard");
+
+var _index = _interopRequireWildcard(require("../index.js"));
+
+var _chai = require("chai");
+
+describe("Test set", function () {
+  it("check set result", function () {
+    var obj = {};
+    (0, _index["default"])(obj, ["a", "b"], "c");
+    (0, _chai.expect)(obj).to.deep.equal({
+      a: {
+        b: "c"
+      }
+    });
+  });
+});
+describe("CVE-2020-28281", function () {
+  it("should not overwrite prototype", function () {
+    var obj = {};
+    (0, _chai.expect)(obj.isAdmin).to.be.undefined;
+    (0, _chai.expect)(function () {
+      return (0, _index["default"])(obj, ["__proto__", "isAdmin"], true);
+    }).to["throw"]();
+    (0, _chai.expect)(function () {
+      return (0, _index["default"])(obj, ["constructor", "isAdmin"], true);
+    }).to["throw"]();
+    (0, _chai.expect)(function () {
+      return (0, _index["default"])(obj, ["prototype", "isAdmin"], true);
+    }).to["throw"]();
+    (0, _chai.expect)(obj.isAdmin).to.be.undefined;
+    (0, _chai.expect)({}.isAdmin).to.be.undefined;
+    (0, _index["default"])(obj, ["isAdmin"], true);
+    (0, _chai.expect)(obj.isAdmin).to.be["true"];
+  });
+  it("should force overwrite prototype with unsafe mode", function () {
+    var obj = {};
+    (0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
+    (0, _chai.expect)(obj.fake).to.be["true"];
+  });
+  it("safe way with unsafe set", function () {
+    var obj = Object.create(null);
+    (0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
+    (0, _chai.expect)(obj.fake).to.be.undefined;
+    (0, _chai.expect)(obj.__proto__.fake).to.be["true"];
+    var obj2 = Object.create(null);
+    (0, _chai.expect)({}.fake).to.be["true"]; // bad case
+
+    (0, _chai.expect)(obj2.fake).to.be.undefined;
+  });
+});
+describe("Test append", function () {
+  it("test simple append", function () {
+    var obj = {};
+    (0, _index["default"])(obj, ["a"], "a1", true);
+    (0, _index["default"])(obj, ["a"], "a2", true);
+    (0, _chai.expect)(obj).to.deep.equal({
+      a: ["a1", "a2"]
+    });
+  });
+  it("should keep origin value", function () {
+    var obj = {};
+    (0, _index["default"])(obj, ["a"], "a3");
+    (0, _index["default"])(obj, ["a"], "a4", true);
+    (0, _chai.expect)(obj).to.deep.equal({
+      a: ["a3", "a4"]
+    });
+  });
+  it("last is not array", function () {
+    var obj = {
+      a: {
+        b: "foo"
+      }
+    };
+    (0, _index["default"])(obj, ["a", "b"], "bar", true);
+    (0, _chai.expect)(obj.a.b).to.deep.equal(["foo", "bar"]);
+  });
+});

package/build/cjs/src/index.js

@@ -1,22 +1,48 @@
-'use strict';
+"use strict";
 
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-var replaceValue = function replaceValue(obj, arrKey, val, isAppend) {
-  var last = arrKey.pop();
-  arrKey.forEach(function (k) {
-    obj[k] = obj[k] || {};
-    obj = obj[k];
+exports.unsafeSet = exports["default"] = void 0;
+
+var isPrototypePolluted = function isPrototypePolluted(arrPath) {
+  var joinPath = "|".concat(arrPath.join("|"), "|");
+  return ["__proto__", "constructor", "prototype"].some(function (key) {
+    return -1 !== joinPath.indexOf("|".concat(key, "|"));
+  });
+};
+
+var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (!unSafe && isPrototypePolluted(arrPath)) {
+    throw "Contain un-safe key.";
+  }
+
+  var last = arrPath.pop();
+  var linkObj = obj;
+  arrPath.forEach(function (k) {
+    var _linkObj$k;
+
+    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    linkObj = linkObj[k];
   });
-  if (isAppend && !obj[last]) {
-    obj[last] = [val];
-  } else if (isAppend && obj[last].push) {
-    obj[last].push(val);
+
+  if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
+    if (!linkObj[last]) {
+      linkObj[last] = [val];
+    } else {
+      linkObj[last] = [linkObj[last], val];
+    }
+  } else if (isAppend && linkObj[last].push) {
+    linkObj[last].push(val);
   } else {
-    obj[last] = val;
+    linkObj[last] = val;
   }
 };
 
-exports.default = replaceValue;
-module.exports = exports['default'];
+var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+  return replaceValue(obj, arrPath, val, isAppend, true);
+};
+
+exports.unsafeSet = unsafeSet;
+var _default = replaceValue;
+exports["default"] = _default;

package/build/es/src/__tests__/IndexTest.js

@@ -0,0 +1,74 @@
+import set, { unsafeSet } from "../index.js";
+import { expect } from "chai";
+describe("Test set", function () {
+  it("check set result", function () {
+    var obj = {};
+    set(obj, ["a", "b"], "c");
+    expect(obj).to.deep.equal({
+      a: {
+        b: "c"
+      }
+    });
+  });
+});
+describe("CVE-2020-28281", function () {
+  it("should not overwrite prototype", function () {
+    var obj = {};
+    expect(obj.isAdmin).to.be.undefined;
+    expect(function () {
+      return set(obj, ["__proto__", "isAdmin"], true);
+    }).to["throw"]();
+    expect(function () {
+      return set(obj, ["constructor", "isAdmin"], true);
+    }).to["throw"]();
+    expect(function () {
+      return set(obj, ["prototype", "isAdmin"], true);
+    }).to["throw"]();
+    expect(obj.isAdmin).to.be.undefined;
+    expect({}.isAdmin).to.be.undefined;
+    set(obj, ["isAdmin"], true);
+    expect(obj.isAdmin).to.be["true"];
+  });
+  it("should force overwrite prototype with unsafe mode", function () {
+    var obj = {};
+    unsafeSet(obj, ["__proto__", "fake"], true);
+    expect(obj.fake).to.be["true"];
+  });
+  it("safe way with unsafe set", function () {
+    var obj = Object.create(null);
+    unsafeSet(obj, ["__proto__", "fake"], true);
+    expect(obj.fake).to.be.undefined;
+    expect(obj.__proto__.fake).to.be["true"];
+    var obj2 = Object.create(null);
+    expect({}.fake).to.be["true"]; // bad case
+
+    expect(obj2.fake).to.be.undefined;
+  });
+});
+describe("Test append", function () {
+  it("test simple append", function () {
+    var obj = {};
+    set(obj, ["a"], "a1", true);
+    set(obj, ["a"], "a2", true);
+    expect(obj).to.deep.equal({
+      a: ["a1", "a2"]
+    });
+  });
+  it("should keep origin value", function () {
+    var obj = {};
+    set(obj, ["a"], "a3");
+    set(obj, ["a"], "a4", true);
+    expect(obj).to.deep.equal({
+      a: ["a3", "a4"]
+    });
+  });
+  it("last is not array", function () {
+    var obj = {
+      a: {
+        b: "foo"
+      }
+    };
+    set(obj, ["a", "b"], "bar", true);
+    expect(obj.a.b).to.deep.equal(["foo", "bar"]);
+  });
+});

package/build/es/src/index.js

@@ -1,18 +1,40 @@
-'use strict';
+var isPrototypePolluted = function isPrototypePolluted(arrPath) {
+  var joinPath = "|".concat(arrPath.join("|"), "|");
+  return ["__proto__", "constructor", "prototype"].some(function (key) {
+    return -1 !== joinPath.indexOf("|".concat(key, "|"));
+  });
+};
+
+var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (!unSafe && isPrototypePolluted(arrPath)) {
+    throw "Contain un-safe key.";
+  }
 
-var replaceValue = function replaceValue(obj, arrKey, val, isAppend) {
-  var last = arrKey.pop();
-  arrKey.forEach(function (k) {
-    obj[k] = obj[k] || {};
-    obj = obj[k];
+  var last = arrPath.pop();
+  var linkObj = obj;
+  arrPath.forEach(function (k) {
+    var _linkObj$k;
+
+    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    linkObj = linkObj[k];
   });
-  if (isAppend && !obj[last]) {
-    obj[last] = [val];
-  } else if (isAppend && obj[last].push) {
-    obj[last].push(val);
+
+  if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
+    if (!linkObj[last]) {
+      linkObj[last] = [val];
+    } else {
+      linkObj[last] = [linkObj[last], val];
+    }
+  } else if (isAppend && linkObj[last].push) {
+    linkObj[last].push(val);
   } else {
-    obj[last] = val;
+    linkObj[last] = val;
   }
 };
 
-export default replaceValue;
+var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+  return replaceValue(obj, arrPath, val, isAppend, true);
+};
+
+export default replaceValue;
+export { unsafeSet };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "set-object-value",
-  "version": "0.0.3",
+  "version": "0.0.8",
   "description": "set object nested value",
   "repository": "react-atomic/react-atomic-organism",
   "main": "./build/cjs/src/index.js",
@@ -10,21 +10,19 @@
   "license": "MIT",
   "dependencies": {},
   "devDependencies": {
-    "babel-cli": "*",
+    "@babel/cli": "^7.x",
     "chai": "*",
     "mocha": "*"
   },
   "scripts": {
-    "build:cjs": "BABEL_ENV=build babel src -d build/cjs/src",
-    "build:es": "BABEL_ENV=es babel src -d build/es/src",
-    "build": "rm -rf build && npm run build:cjs && npm run build:es",
-    "prepublishOnly": "npm run test && npm run build",
-    "build:test": "BABEL_ENV=build babel tests -d build/tests",
-    "test": "npm run build && npm run build:test && mocha 'build/tests/**/*.js'"
+    "clean": "find ./build -name '*.*' | xargs rm -rf",
+    "build": "npm run clean && npm run build:cjs && npm run build:es",
+    "build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --root-mode upward",
+    "build:es": "BABEL_ENV=es babel src -d build/es/src --root-mode upward",
+    "mochaFor": "mocha",
+    "mocha": "npm run mochaFor -- 'build/cjs/**/__tests__/*.js'",
+    "test": "npm run build && npm run mocha",
+    "prepublishOnly": "npm run test"
   },
-  "files": [
-    "build",
-    "package.json",
-    "README.md"
-  ]
+  "files": ["build", "package.json", "README.md"]
 }