set-object-value 0.0.5 → 0.1.0

package/build/cjs/src/index.js

@@ -3,28 +3,46 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports["default"] = void 0;
+exports.unsafeSet = exports["default"] = void 0;
 
-var replaceValue = function replaceValue(obj, arrKey, val, isAppend) {
-  var last = arrKey.pop();
-  arrKey.forEach(function (k) {
-    obj[k] = obj[k] || {};
-    obj = obj[k];
+var isPrototypePolluted = function isPrototypePolluted(arrPath) {
+  var joinPath = "|".concat(arrPath.join("|"), "|");
+  return ["__proto__", "constructor", "prototype"].some(function (key) {
+    return -1 !== joinPath.indexOf("|".concat(key, "|"));
   });
+};
+
+var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (!unSafe && isPrototypePolluted(arrPath)) {
+    throw "Contain un-safe key.";
+  }
+
+  var last = arrPath.pop();
+  var linkObj = obj;
+  arrPath.forEach(function (k) {
+    var _linkObj$k;
 
-  if (isAppend && (!obj[last] || !obj[last].push)) {
-    if (!obj[last]) {
-      obj[last] = [val];
+    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    linkObj = linkObj[k];
+  });
+
+  if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
+    if (!linkObj[last]) {
+      linkObj[last] = [val];
     } else {
-      obj[last] = [obj[last], val];
+      linkObj[last] = [linkObj[last], val];
     }
-  } else if (isAppend && obj[last].push) {
-    obj[last].push(val);
+  } else if (isAppend && linkObj[last].push) {
+    linkObj[last].push(val);
   } else {
-    obj[last] = val;
+    linkObj[last] = val;
   }
 };
 
+var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+  return replaceValue(obj, arrPath, val, isAppend, true);
+};
+
+exports.unsafeSet = unsafeSet;
 var _default = replaceValue;
-exports["default"] = _default;
-module.exports = exports.default;
+exports["default"] = _default;

package/build/es/src/__tests__/IndexTest.mjs

@@ -0,0 +1,74 @@
+import set, { unsafeSet } from "../index.mjs";
+import { expect } from "chai";
+describe("Test set", function () {
+  it("check set result", function () {
+    var obj = {};
+    set(obj, ["a", "b"], "c");
+    expect(obj).to.deep.equal({
+      a: {
+        b: "c"
+      }
+    });
+  });
+});
+describe("CVE-2020-28281", function () {
+  it("should not overwrite prototype", function () {
+    var obj = {};
+    expect(obj.isAdmin).to.be.undefined;
+    expect(function () {
+      return set(obj, ["__proto__", "isAdmin"], true);
+    }).to["throw"]();
+    expect(function () {
+      return set(obj, ["constructor", "isAdmin"], true);
+    }).to["throw"]();
+    expect(function () {
+      return set(obj, ["prototype", "isAdmin"], true);
+    }).to["throw"]();
+    expect(obj.isAdmin).to.be.undefined;
+    expect({}.isAdmin).to.be.undefined;
+    set(obj, ["isAdmin"], true);
+    expect(obj.isAdmin).to.be["true"];
+  });
+  it("should force overwrite prototype with unsafe mode", function () {
+    var obj = {};
+    unsafeSet(obj, ["__proto__", "fake"], true);
+    expect(obj.fake).to.be["true"];
+  });
+  it("safe way with unsafe set", function () {
+    var obj = Object.create(null);
+    unsafeSet(obj, ["__proto__", "fake"], true);
+    expect(obj.fake).to.be.undefined;
+    expect(obj.__proto__.fake).to.be["true"];
+    var obj2 = Object.create(null);
+    expect({}.fake).to.be["true"]; // bad case
+
+    expect(obj2.fake).to.be.undefined;
+  });
+});
+describe("Test append", function () {
+  it("test simple append", function () {
+    var obj = {};
+    set(obj, ["a"], "a1", true);
+    set(obj, ["a"], "a2", true);
+    expect(obj).to.deep.equal({
+      a: ["a1", "a2"]
+    });
+  });
+  it("should keep origin value", function () {
+    var obj = {};
+    set(obj, ["a"], "a3");
+    set(obj, ["a"], "a4", true);
+    expect(obj).to.deep.equal({
+      a: ["a3", "a4"]
+    });
+  });
+  it("last is not array", function () {
+    var obj = {
+      a: {
+        b: "foo"
+      }
+    };
+    set(obj, ["a", "b"], "bar", true);
+    expect(obj.a.b).to.deep.equal(["foo", "bar"]);
+  });
+});

package/build/es/src/index.mjs

@@ -0,0 +1,40 @@
+var isPrototypePolluted = function isPrototypePolluted(arrPath) {
+  var joinPath = "|".concat(arrPath.join("|"), "|");
+  return ["__proto__", "constructor", "prototype"].some(function (key) {
+    return -1 !== joinPath.indexOf("|".concat(key, "|"));
+  });
+};
+
+var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (!unSafe && isPrototypePolluted(arrPath)) {
+    throw "Contain un-safe key.";
+  }
+
+  var last = arrPath.pop();
+  var linkObj = obj;
+  arrPath.forEach(function (k) {
+    var _linkObj$k;
+
+    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    linkObj = linkObj[k];
+  });
+
+  if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
+    if (!linkObj[last]) {
+      linkObj[last] = [val];
+    } else {
+      linkObj[last] = [linkObj[last], val];
+    }
+  } else if (isAppend && linkObj[last].push) {
+    linkObj[last].push(val);
+  } else {
+    linkObj[last] = val;
+  }
+};
+
+var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+  return replaceValue(obj, arrPath, val, isAppend, true);
+};
+
+export default replaceValue;
+export { unsafeSet };

package/package.json

@@ -1,10 +1,19 @@
 {
+  "version": "0.1.0",
   "name": "set-object-value",
-  "version": "0.0.5",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/react-atomic/react-atomic-organism",
+    "directory": "packages/lib/set-object-value"
+  },
+  "homepage": "https://github.com/react-atomic/react-atomic-organism/tree/main/packages/lib/set-object-value",
   "description": "set object nested value",
-  "repository": "react-atomic/react-atomic-organism",
   "main": "./build/cjs/src/index.js",
-  "module": "./build/es/src/index.js",
+  "module": "./build/es/src/index.mjs",
+  "exports": {
+    "require": "./build/cjs/src/index.js",
+    "import": "./build/es/src/index.mjs"
+  },
   "keywords": [],
   "author": "Hill <hill@kimo.com>",
   "license": "MIT",
@@ -15,11 +24,14 @@
     "mocha": "*"
   },
   "scripts": {
-    "build:cjs": "BABEL_ENV=build babel src -d build/cjs/src --root-mode upward",
-    "build:es": "BABEL_ENV=es babel src -d build/es/src --root-mode upward",
-    "build": "rm -rf build && npm run build:cjs && npm run build:es",
-    "prepublishOnly": "npm run test && npm run build",
-    "test": "npm run build && mocha 'build/cjs/**/__tests__/*.js'"
+    "clean": "find ./build -name '*.*' | xargs rm -rf",
+    "build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --ignore /**/__tests__ --root-mode upward",
+    "build:es": "BABEL_ENV=es babel src -d build/es/src --out-file-extension .mjs --root-mode upward",
+    "build": "npm run clean && npm run build:cjs && npm run build:es",
+    "mochaFor": "mocha",
+    "mocha": "npm run mochaFor -- 'build/es/**/__tests__/*.mjs'",
+    "test": "npm run build && npm run mocha",
+    "prepublishOnly": "npm run test"
   },
   "files": [
     "build",

package/build/cjs/src/__tests__/IndexTest.js

@@ -1,37 +0,0 @@
-'use strict';
-
-var _interopRequireDefault = require("reshow-runtime/helpers/interopRequireDefault");
-
-var _index = _interopRequireDefault(require("../index.js"));
-
-var _chai = require("chai");
-
-describe('Test set', function () {
-  it('check set result', function () {
-    var obj = {};
-    (0, _index["default"])(obj, ['a', 'b'], 'c');
-    (0, _chai.expect)(obj).to.deep.equal({
-      a: {
-        b: 'c'
-      }
-    });
-  });
-});
-describe('Test append', function () {
-  it('test simple append', function () {
-    var obj = {};
-    (0, _index["default"])(obj, ['a'], 'a1', true);
-    (0, _index["default"])(obj, ['a'], 'a2', true);
-    (0, _chai.expect)(obj).to.deep.equal({
-      a: ['a1', 'a2']
-    });
-  });
-  it('should keep origin value', function () {
-    var obj = {};
-    (0, _index["default"])(obj, ['a'], 'a3');
-    (0, _index["default"])(obj, ['a'], 'a4', true);
-    (0, _chai.expect)(obj).to.deep.equal({
-      a: ['a3', 'a4']
-    });
-  });
-});

package/build/es/src/__tests__/IndexTest.js

@@ -1,33 +0,0 @@
-'use strict';
-
-import set from '../index.js';
-import { expect } from 'chai';
-describe('Test set', function () {
-  it('check set result', function () {
-    var obj = {};
-    set(obj, ['a', 'b'], 'c');
-    expect(obj).to.deep.equal({
-      a: {
-        b: 'c'
-      }
-    });
-  });
-});
-describe('Test append', function () {
-  it('test simple append', function () {
-    var obj = {};
-    set(obj, ['a'], 'a1', true);
-    set(obj, ['a'], 'a2', true);
-    expect(obj).to.deep.equal({
-      a: ['a1', 'a2']
-    });
-  });
-  it('should keep origin value', function () {
-    var obj = {};
-    set(obj, ['a'], 'a3');
-    set(obj, ['a'], 'a4', true);
-    expect(obj).to.deep.equal({
-      a: ['a3', 'a4']
-    });
-  });
-});

package/build/es/src/index.js

@@ -1,21 +0,0 @@
-var replaceValue = function replaceValue(obj, arrKey, val, isAppend) {
-  var last = arrKey.pop();
-  arrKey.forEach(function (k) {
-    obj[k] = obj[k] || {};
-    obj = obj[k];
-  });
-
-  if (isAppend && (!obj[last] || !obj[last].push)) {
-    if (!obj[last]) {
-      obj[last] = [val];
-    } else {
-      obj[last] = [obj[last], val];
-    }
-  } else if (isAppend && obj[last].push) {
-    obj[last].push(val);
-  } else {
-    obj[last] = val;
-  }
-};
-
-export default replaceValue;