set-object-value 0.2.0 → 0.3.0

package/build/cjs/src/index.js

@@ -1,39 +1,72 @@
 "use strict";
 
-exports.__esModule = true;
+var _interopRequireDefault = require("reshow-runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
 exports.unsafeSet = exports["default"] = void 0;
+var _typeof2 = _interopRequireDefault(require("reshow-runtime/helpers/typeof"));
 // @ts-check
 
 /**
- * @param {string[]} arrPath
- * @returns {boolean}
+ * Check whether the given path contains a prototype-polluting key.
+ *
+ * @param {readonly (string | number)[]} arrPath - The path segments to inspect.
+ * @returns {boolean} `true` when the path contains `__proto__`, `constructor`, or `prototype`.
  */
+var DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 var isPrototypePolluted = function isPrototypePolluted(arrPath) {
-  var joinPath = "|" + arrPath.join("|") + "|";
-  return ["__proto__", "constructor", "prototype"].some(function (key) {
-    return -1 !== joinPath.indexOf("|" + key + "|");
+  return arrPath.some(function (key) {
+    return DANGEROUS_KEYS.has(String(key));
   });
 };
 
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
- * @param {boolean} [unSafe]
+ * Set (or replace) a nested value on `obj` following `arrPath`.
+ *
+ * Intermediate objects are created as needed using `Object.create(null)`
+ * (null-prototype objects) to avoid prototype pollution.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array
+ *   (or wrap the existing value into an array) instead of overwriting.
+ * @param {boolean} [unSafe=false] - When true, skip the prototype-pollution guard.
+ * @returns {void}
+ * @example
+ * const obj = {};
+ * replaceValue(obj, ["a", "b"], "c");
+ * // obj => { a: { b: "c" } }
+ * @throws {Error} Throws when the path contains a prototype-polluting key and
+ *   `unSafe` is not enabled, or when `arrPath` is empty.
+ * @throws {TypeError} Throws when `obj` is not an object, `arrPath` is not an
+ *   array, or an intermediate path segment is not an object.
  */
 var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (obj == null || (0, _typeof2["default"])(obj) !== "object") {
+    throw new TypeError("Target must be an object.");
+  }
+  if (!Array.isArray(arrPath)) {
+    throw new TypeError("Path must be an array.");
+  }
+  if (arrPath.length === 0) {
+    throw new Error("Path must not be empty.");
+  }
   if (!unSafe && isPrototypePolluted(arrPath)) {
-    throw "Contain un-safe key.";
+    throw new Error("Contain un-safe key.");
   }
-  /**
-   * @type string
-   */
-  var last = /** @type string */arrPath.pop();
+  var last = /** @type {string | number} */arrPath[arrPath.length - 1];
+  var parents = arrPath.slice(0, -1);
+  /** @type {any} */
   var linkObj = obj;
-  arrPath.forEach(function (k) {
+  parents.forEach(function (k) {
     var _linkObj$k;
-    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    if (linkObj[k] != null && (0, _typeof2["default"])(linkObj[k]) !== "object") {
+      throw new TypeError("Cannot set property along path: \"" + k + "\" is not an object.");
+    }
+    linkObj[k] = (_linkObj$k = linkObj[k]) != null ? _linkObj$k : Object.create(null);
     linkObj = linkObj[k];
   });
   if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
@@ -50,14 +83,18 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
 };
 
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
+ * Unsafe variant of {@link replaceValue} that bypasses the prototype-pollution guard.
+ *
+ * Use only when the path is trusted or the target is a null-prototype object.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array.
+ * @returns {void}
  */
-var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+var unsafeSet = exports.unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
   return replaceValue(obj, arrPath, val, isAppend, true);
 };
-exports.unsafeSet = unsafeSet;
-var _default = replaceValue;
-exports["default"] = _default;
+var _default = exports["default"] = replaceValue;

package/build/es/src/__tests__/IndexTest.mjs

@@ -2,7 +2,7 @@ import { expect } from "chai";
 import set, { unsafeSet } from "../index.mjs";
 describe("Test set", function () {
   it("check set result", function () {
-    var obj = {};
+    const obj = {};
     set(obj, ["a", "b"], "c");
     expect(obj).to.deep.equal({
       a: {
@@ -13,7 +13,7 @@ describe("Test set", function () {
 });
 describe("CVE-2020-28281", function () {
   it("should not overwrite prototype", function () {
-    var obj = {};
+    const obj = {};
     expect(obj.isAdmin).to.be.undefined;
     expect(function () {
       return set(obj, ["__proto__", "isAdmin"], true);
@@ -30,23 +30,23 @@ describe("CVE-2020-28281", function () {
     expect(obj.isAdmin).to.be.true;
   });
   it("should force overwrite prototype with unsafe mode", function () {
-    var obj = {};
+    const obj = {};
     unsafeSet(obj, ["__proto__", "fake"], true);
     expect(obj.fake).to.be.true;
   });
   it("safe way with unsafe set", function () {
-    var obj = Object.create(null);
+    const obj = Object.create(null);
     unsafeSet(obj, ["__proto__", "fake"], true);
     expect(obj.fake).to.be.undefined;
     expect(obj.__proto__.fake).to.be.true;
-    var obj2 = Object.create(null);
+    const obj2 = Object.create(null);
     expect({}.fake).to.be.true; // bad case
     expect(obj2.fake).to.be.undefined;
   });
 });
 describe("Test append", function () {
   it("test simple append", function () {
-    var obj = {};
+    const obj = {};
     set(obj, ["a"], "a1", true);
     set(obj, ["a"], "a2", true);
     expect(obj).to.deep.equal({
@@ -54,7 +54,7 @@ describe("Test append", function () {
     });
   });
   it("should keep origin value", function () {
-    var obj = {};
+    const obj = {};
     set(obj, ["a"], "a3");
     set(obj, ["a"], "a4", true);
     expect(obj).to.deep.equal({
@@ -62,7 +62,7 @@ describe("Test append", function () {
     });
   });
   it("last is not array", function () {
-    var obj = {
+    const obj = {
       a: {
         b: "foo"
       }

package/build/es/src/index.mjs

@@ -1,35 +1,64 @@
 // @ts-check
 
 /**
- * @param {string[]} arrPath
- * @returns {boolean}
+ * Check whether the given path contains a prototype-polluting key.
+ *
+ * @param {readonly (string | number)[]} arrPath - The path segments to inspect.
+ * @returns {boolean} `true` when the path contains `__proto__`, `constructor`, or `prototype`.
  */
-var isPrototypePolluted = function isPrototypePolluted(arrPath) {
-  var joinPath = "|" + arrPath.join("|") + "|";
-  return ["__proto__", "constructor", "prototype"].some(function (key) {
-    return -1 !== joinPath.indexOf("|" + key + "|");
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const isPrototypePolluted = function isPrototypePolluted(arrPath) {
+  return arrPath.some(function (key) {
+    return DANGEROUS_KEYS.has(String(key));
   });
 };
 
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
- * @param {boolean} [unSafe]
+ * Set (or replace) a nested value on `obj` following `arrPath`.
+ *
+ * Intermediate objects are created as needed using `Object.create(null)`
+ * (null-prototype objects) to avoid prototype pollution.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array
+ *   (or wrap the existing value into an array) instead of overwriting.
+ * @param {boolean} [unSafe=false] - When true, skip the prototype-pollution guard.
+ * @returns {void}
+ * @example
+ * const obj = {};
+ * replaceValue(obj, ["a", "b"], "c");
+ * // obj => { a: { b: "c" } }
+ * @throws {Error} Throws when the path contains a prototype-polluting key and
+ *   `unSafe` is not enabled, or when `arrPath` is empty.
+ * @throws {TypeError} Throws when `obj` is not an object, `arrPath` is not an
+ *   array, or an intermediate path segment is not an object.
  */
-var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+const replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
+  if (obj == null || typeof obj !== "object") {
+    throw new TypeError("Target must be an object.");
+  }
+  if (!Array.isArray(arrPath)) {
+    throw new TypeError("Path must be an array.");
+  }
+  if (arrPath.length === 0) {
+    throw new Error("Path must not be empty.");
+  }
   if (!unSafe && isPrototypePolluted(arrPath)) {
-    throw "Contain un-safe key.";
+    throw new Error("Contain un-safe key.");
   }
-  /**
-   * @type string
-   */
-  var last = /** @type string */arrPath.pop();
-  var linkObj = obj;
-  arrPath.forEach(function (k) {
+  const last = /** @type {string | number} */arrPath[arrPath.length - 1];
+  const parents = arrPath.slice(0, -1);
+  /** @type {any} */
+  let linkObj = obj;
+  parents.forEach(function (k) {
     var _linkObj$k;
-    linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
+    if (linkObj[k] != null && typeof linkObj[k] !== "object") {
+      throw new TypeError(`Cannot set property along path: "${k}" is not an object.`);
+    }
+    linkObj[k] = (_linkObj$k = linkObj[k]) != null ? _linkObj$k : Object.create(null);
     linkObj = linkObj[k];
   });
   if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
@@ -46,12 +75,18 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
 };
 
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
+ * Unsafe variant of {@link replaceValue} that bypasses the prototype-pollution guard.
+ *
+ * Use only when the path is trusted or the target is a null-prototype object.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array.
+ * @returns {void}
  */
-var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
+const unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
   return replaceValue(obj, arrPath, val, isAppend, true);
 };
 export default replaceValue;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.0",
+  "version": "0.3.0",
   "name": "set-object-value",
   "repository": {
     "type": "git",
@@ -8,26 +8,32 @@
   },
   "homepage": "https://github.com/react-atomic/react-atomic-organism/tree/main/packages/lib/set-object-value",
   "description": "set object nested value",
-  "main": "./build/cjs/src/index.js",
-  "module": "./build/es/src/index.mjs",
   "exports": {
-    "require": "./build/cjs/src/index.js",
-    "import": "./build/es/src/index.mjs"
+    ".": {
+      "types": "./types/index.d.ts",
+      "require": "./build/cjs/src/index.js",
+      "import": "./build/es/src/index.mjs"
+    }
   },
+  "types": "./types/index.d.ts",
+  "main": "./build/cjs/src/index.js",
+  "module": "./build/es/src/index.mjs",
   "keywords": [],
   "author": "Hill <hill@kimo.com>",
   "license": "MIT",
   "dependencies": {},
   "devDependencies": {
-    "@babel/cli": "^7.x",
+    "@babel/cli": "^8.1.0",
+    "@babel/core": "^8.1.2",
     "chai": "*",
-    "mocha": "*"
+    "mocha": "*",
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "clean": "find ./build ./types -name '*.*' | xargs rm -rf",
     "build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --ignore /**/__tests__ --root-mode upward",
     "build:es": "BABEL_ENV=es babel src -d build/es/src --out-file-extension .mjs --root-mode upward",
-    "build:type": "npx -p typescript tsc src/*.js --declaration --allowJs --emitDeclarationOnly --skipLibCheck --declarationDir types",
+    "build:type": "tsc src/*.js --declaration --allowJs --emitDeclarationOnly --skipLibCheck --declarationDir types --resolvePackageJsonExports false --strict false",
     "build": "npm run clean && npm run build:cjs && npm run build:es && npm run build:type",
     "mochaFor": "mocha",
     "mocha": "npm run mochaFor -- 'build/es/**/__tests__/*.mjs'",
@@ -35,7 +41,6 @@
     "test": "npm run build && npm run mocha",
     "prepublishOnly": "npm run test"
   },
-  "types": "./types/index.d.ts",
   "files": [
     "types",
     "build",

package/types/index.d.ts

@@ -1,16 +1,39 @@
-export default replaceValue;
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
- * @param {boolean} [unSafe]
+ * Set (or replace) a nested value on `obj` following `arrPath`.
+ *
+ * Intermediate objects are created as needed using `Object.create(null)`
+ * (null-prototype objects) to avoid prototype pollution.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array
+ *   (or wrap the existing value into an array) instead of overwriting.
+ * @param {boolean} [unSafe=false] - When true, skip the prototype-pollution guard.
+ * @returns {void}
+ * @example
+ * const obj = {};
+ * replaceValue(obj, ["a", "b"], "c");
+ * // obj => { a: { b: "c" } }
+ * @throws {Error} Throws when the path contains a prototype-polluting key and
+ *   `unSafe` is not enabled, or when `arrPath` is empty.
+ * @throws {TypeError} Throws when `obj` is not an object, `arrPath` is not an
+ *   array, or an intermediate path segment is not an object.
  */
-declare function replaceValue(obj: any, arrPath: string[], val: any, isAppend?: boolean, unSafe?: boolean): void;
+declare const replaceValue: <T extends object>(obj: T, arrPath: readonly (string | number)[], val: any, isAppend?: boolean, unSafe?: boolean) => void;
 /**
- * @param {any} obj
- * @param {string[]} arrPath
- * @param {any} val
- * @param {boolean} [isAppend]
+ * Unsafe variant of {@link replaceValue} that bypasses the prototype-pollution guard.
+ *
+ * Use only when the path is trusted or the target is a null-prototype object.
+ *
+ * @template {object} T
+ * @param {T} obj - The target object to mutate.
+ * @param {readonly (string | number)[]} arrPath - Path segments leading to the value to set.
+ * @param {any} val - The value to assign (or append when `isAppend` is true).
+ * @param {boolean} [isAppend=false] - When true, append `val` to an existing array.
+ * @returns {void}
  */
-export function unsafeSet(obj: any, arrPath: string[], val: any, isAppend?: boolean): void;
+declare const unsafeSet: <T extends object>(obj: T, arrPath: readonly (string | number)[], val: any, isAppend?: boolean) => void;
+export default replaceValue;
+export { unsafeSet };