sharedb 6.0.2 → 6.0.4

package/README.md

@@ -1,8 +1,8 @@
 # ShareDB
 
   [![NPM Version](https://img.shields.io/npm/v/sharedb.svg)](https://npmjs.org/package/sharedb)
-  ![Test](https://github.com/share/sharedb/workflows/Test/badge.svg)
-  [![Coverage Status](https://coveralls.io/repos/github/share/sharedb/badge.svg?branch=master)](https://coveralls.io/github/share/sharedb?branch=master)
+  ![Test](https://github.com/share/sharedb/actions/workflows/test.yml/badge.svg?branch=main)
+  [![Coverage Status](https://coveralls.io/repos/github/share/sharedb/badge.svg?branch=main)](https://coveralls.io/github/share/sharedb?branch=main)
 
 ShareDB is a realtime database backend based on [Operational Transformation
 (OT)](https://en.wikipedia.org/wiki/Operational_transformation) of JSON

package/lib/agent.js

@@ -388,6 +388,8 @@ Agent.prototype._checkRequest = function(request) {
       request.a === ACTIONS.fetch ||
       request.a === ACTIONS.subscribe ||
       request.a === ACTIONS.unsubscribe ||
+      request.a === ACTIONS.snapshotFetch ||
+      request.a === ACTIONS.snapshotFetchByTimestamp ||
       request.a === ACTIONS.presence) {
     // Doc-based request.
     if (request.c != null) {
@@ -401,6 +403,11 @@ Agent.prototype._checkRequest = function(request) {
       }
     }
 
+    if (request.a === ACTIONS.snapshotFetch || request.a === ACTIONS.snapshotFetchByTimestamp) {
+      if (request.c == null) return 'Invalid collection';
+      if (request.d == null) return 'Invalid id';
+    }
+
     if (request.a === ACTIONS.op || request.a === ACTIONS.presence) {
       if (request.v != null && (typeof request.v !== 'number' || request.v < 0)) return 'Invalid version';
     }

package/lib/backend.js

@@ -106,10 +106,7 @@ Backend.prototype.close = function(callback) {
   var wait = 4;
   var backend = this;
   function finish(err) {
-    if (err) {
-      if (callback) return callback(err);
-      return backend.emit('error', err);
-    }
+    if (err) return util.callbackOrEmit(backend, err, callback);
     if (--wait) return;
     if (callback) callback();
   }

package/lib/client/doc.js

@@ -1,5 +1,6 @@
 var emitter = require('../emitter');
 var logger = require('../logger');
+var ot = require('../ot');
 var ShareDBError = require('../error');
 var types = require('../types');
 var util = require('../util');
@@ -130,10 +131,7 @@ Doc.prototype.destroy = function(callback) {
   doc.whenNothingPending(function() {
     if (doc.wantSubscribe) {
       doc.unsubscribe(function(err) {
-        if (err) {
-          if (callback) return callback(err);
-          return doc.emit('error', err);
-        }
+        if (err) return util.callbackOrEmit(doc, err, callback);
         doc.connection._destroyDoc(doc);
         if (callback) callback();
       });
@@ -190,8 +188,7 @@ Doc.prototype.ingestSnapshot = function(snapshot, callback) {
       ERROR_CODE.ERR_INGESTED_SNAPSHOT_HAS_NO_VERSION,
       'Missing version in ingested snapshot. ' + this.collection + '.' + this.id
     );
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
 
   // If the doc is already created or there are ops pending, we cannot use the
@@ -213,8 +210,7 @@ Doc.prototype.ingestSnapshot = function(snapshot, callback) {
         ERROR_CODE.ERR_DOC_MISSING_VERSION,
         'Cannot ingest snapshot in doc with null version. ' + this.collection + '.' + this.id
       );
-      if (callback) return callback(err);
-      return this.emit('error', err);
+      return util.callbackOrEmit(this, err, callback);
     }
     // If we got a snapshot for a version further along than the document is
     // currently, issue a fetch to get the latest ops and catch us up
@@ -599,6 +595,9 @@ Doc.prototype._otApply = function(op, source) {
       );
     }
 
+    var pathError = ot.checkOpPathsForType(this.type, op);
+    if (pathError) throw pathError;
+
     // NB: If we need to add another argument to this event, we should consider
     // the fact that the 'op' event has op.src as its 3rd argument
     this.emit('before op batch', op.op, source);
@@ -760,11 +759,15 @@ Doc.prototype._submit = function(op, source, callback) {
         );
       }
 
-      if (callback) return callback(err);
-      return this.emit('error', err);
+      return util.callbackOrEmit(this, err, callback);
     }
     // Try to normalize the op. This removes trailing skip:0's and things like that.
     if (this.type.normalize) op.op = this.type.normalize(op.op);
+
+    // This has to happen before _pushOp(), because _tryCompose() applies the op
+    // to a pending create, well before _otApply() gets a chance to check it
+    var pathError = ot.checkOpPathsForType(this.type, op);
+    if (pathError) return util.callbackOrEmit(this, pathError, callback);
   }
 
   try {
@@ -901,8 +904,7 @@ Doc.prototype.create = function(data, type, options, callback) {
   }
   if (this.type) {
     var err = new ShareDBError(ERROR_CODE.ERR_DOC_ALREADY_CREATED, 'Document already exists');
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   var op = {create: {type: type, data: data}};
   var source = options && options.source;
@@ -923,8 +925,7 @@ Doc.prototype.del = function(options, callback) {
   }
   if (!this.type) {
     var err = new ShareDBError(ERROR_CODE.ERR_DOC_DOES_NOT_EXIST, 'Document does not exist');
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   var op = {del: true};
   var source = options && options.source;

package/lib/client/query.js

@@ -149,8 +149,7 @@ Query.prototype._finishResponse = function(err, callback) {
   this.ready = true;
   if (err) {
     this.connection._destroyQuery(this);
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   if (callback) callback(null, this.results, this.extra);
 };

package/lib/ot.js

@@ -108,18 +108,9 @@ function applyOpEdit(snapshot, edit) {
   var type = types.map[snapshot.type];
   if (!type) return new ShareDBError(ERROR_CODE.ERR_DOC_TYPE_NOT_RECOGNIZED, 'Unknown type');
 
-  if (type.name === 'json0' && Array.isArray(edit)) {
-    for (var i = 0; i < edit.length; i++) {
-      var opComponent = edit[i];
-      if (Array.isArray(opComponent.p)) {
-        for (var j = 0; j < opComponent.p.length; j++) {
-          var pathSegment = opComponent.p[j];
-          if (util.isDangerousProperty(pathSegment)) {
-            return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
-          }
-        }
-      }
-    }
+  if (type.name === 'json0') {
+    var pathError = checkJson0OpPaths(edit);
+    if (pathError) return pathError;
   }
 
   try {
@@ -129,6 +120,32 @@ function applyOpEdit(snapshot, edit) {
   }
 }
 
+// ot-json0 walks ops with .length and numeric indexing, so it treats array-like
+// objects as ops too, and it coerces .length. This traversal has to match it
+// exactly: anything ot-json0 will apply has to be checked here.
+// See GHSA-9rqw-j2q5-gg2g
+function checkJson0OpPaths(op) {
+  if (op == null) return;
+  for (var i = 0; i < op.length; i++) {
+    var component = op[i];
+    // ot-json0's checkValidOp() rejects the whole op before applying any of it,
+    // so there is nothing beyond this component left to check
+    if (!component || typeof component !== 'object' || !Array.isArray(component.p)) return;
+    for (var j = 0; j < component.p.length; j++) {
+      if (util.isDangerousProperty(component.p[j])) {
+        return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
+      }
+    }
+  }
+}
+
+exports.checkOpPathsForType = function(type, op) {
+  if (!('op' in op)) return;
+  if (typeof type === 'string') type = types.map[type];
+  if (!type || type.name !== 'json0') return;
+  return checkJson0OpPaths(op.op);
+};
+
 exports.transform = function(type, op, appliedOp) {
   // There are 16 cases this function needs to deal with - which are all the
   // combinations of create/delete/op/noop from both op and appliedOp
@@ -178,6 +195,10 @@ exports.applyOps = function(snapshot, ops, options) {
   options = options || {};
   for (var index = 0; index < ops.length; index++) {
     var op = ops[index];
+    // normalizeLegacyJson0Ops() applies op components itself, so paths have to
+    // be checked before it runs, not just in exports.apply()
+    var pathError = exports.checkOpPathsForType(snapshot.type, op);
+    if (pathError) return pathError;
     if (options._normalizeLegacyJson0Ops) {
       try {
         normalizeLegacyJson0Ops(snapshot, op);

package/lib/projections.js

@@ -58,7 +58,7 @@ function projectEdit(fields, op) {
       }
     } else {
       // The path has a first element. Just check it against the fields.
-      if (fields[path[0]]) {
+      if (isFieldAllowed(fields, path[0])) {
         result.push(c);
       }
     }
@@ -91,7 +91,7 @@ function isSnapshotAllowed(fields, snapshot) {
     return false;
   }
   for (var k in snapshot.data) {
-    if (!fields[k]) return false;
+    if (!isFieldAllowed(fields, k)) return false;
   }
   return true;
 }
@@ -101,13 +101,17 @@ function isEditAllowed(fields, op) {
     var c = op[i];
     if (c.p.length === 0) {
       return false;
-    } else if (!fields[c.p[0]]) {
+    } else if (!isFieldAllowed(fields, c.p[0])) {
       return false;
     }
   }
   return true;
 }
 
+function isFieldAllowed(fields, field) {
+  return util.hasOwn(fields, field) && !!fields[field];
+}
+
 function projectData(fields, data) {
   // Return back null or undefined
   if (data == null) {

package/lib/util.js

@@ -84,6 +84,11 @@ exports.callEach = function(callbacks, error) {
   return called;
 };
 
+exports.callbackOrEmit = function(emitter, error, callback) {
+  if (callback) return callback(error);
+  if (error) emitter.emit('error', error);
+};
+
 exports.truthy = function(arg) {
   return !!arg;
 };
@@ -100,14 +105,13 @@ exports.clone = function(obj) {
   return (obj === undefined) ? undefined : JSON.parse(JSON.stringify(obj));
 };
 
+// A null prototype makes '__proto__' an ordinary own key, so it can be in the map
 var objectProtoPropNames = Object.create(null);
 Object.getOwnPropertyNames(Object.prototype).forEach(function(prop) {
-  if (prop !== '__proto__') {
-    objectProtoPropNames[prop] = true;
-  }
+  objectProtoPropNames[prop] = true;
 });
 exports.isDangerousProperty = function(propName) {
-  return propName === '__proto__' || objectProtoPropNames[propName];
+  return objectProtoPropNames[propName] === true;
 };
 
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sharedb",
-  "version": "6.0.2",
+  "version": "6.0.4",
   "description": "JSON OT database backend",
   "main": "lib/index.js",
   "dependencies": {
@@ -15,7 +15,7 @@
     "chai": "^6.2.2",
     "eslint": "^10.1.0",
     "eslint-config-google": "^0.14.0",
-    "mocha": "^11.7.5",
+    "mocha": "^12.0.0",
     "nyc": "^18.0.0",
     "ot-json0-v2": "https://github.com/ottypes/json0#90a3ae26364c4fa3b19b6df34dad46707a704421",
     "ot-json1": "^1.0.2",

package/test/client/doc.js

@@ -682,6 +682,10 @@ describe('Doc', function() {
       });
     }
 
+    afterEach(function() {
+      delete Object.prototype.polluted;
+    });
+
     ['__proto__', 'constructor'].forEach(function(badProp) {
       it('Rejects ops with collection ' + badProp, function(done) {
         var collectionName = badProp;
@@ -755,6 +759,177 @@ describe('Doc', function() {
         });
       });
     });
+
+    // ot-json0 walks ops with .length and numeric indexing, so it applies an
+    // array-like object as if it were an op
+    [
+      {
+        name: 'an array-like op',
+        op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1}
+      },
+      {
+        name: 'ops with a path segment that is not a string',
+        op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}]
+      }
+    ].forEach(function(test) {
+      it('Rejects ' + test.name, function(done) {
+        var connection = this.connection;
+        var collectionName = 'test-collection';
+        var docId = 'test-doc';
+        connection.get(collectionName, docId).create({id: docId}, function(err) {
+          if (err) {
+            return done(err);
+          }
+          expectReceiveError(connection, collectionName, docId, 'Invalid path segment', function(error) {
+            if (error) {
+              return done(error);
+            }
+            expect({}.polluted).to.equal(undefined);
+            done();
+          });
+          connection.send({
+            a: 'op',
+            c: collectionName,
+            d: docId,
+            v: 1,
+            seq: connection.seq++,
+            x: {},
+            op: test.op
+          });
+        });
+      });
+    });
+
+    function expectInvalidPathSegment(error) {
+      expect(error.code).to.equal(ShareDBError.CODES.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    }
+
+    describe('ops from the server', function() {
+      var multiComponentOp = [{p: ['baz'], oi: true}, {p: ['__proto__', 'polluted'], oi: 'oops'}];
+      var connection;
+      var doc;
+
+      beforeEach(function(done) {
+        connection = this.connection;
+        doc = connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, done);
+      });
+
+      function sendOp(op) {
+        connection.handleMessage({
+          a: 'op',
+          c: doc.collection,
+          d: doc.id,
+          v: 1,
+          src: 'hostile',
+          seq: 1,
+          op: op
+        });
+      }
+
+      [
+        {
+          name: 'ops with a dangerous first path segment',
+          op: [{p: ['__proto__', 'polluted'], oi: 'oops'}]
+        },
+        {
+          name: 'ops with a dangerous later path segment',
+          op: [{p: ['foo', 'constructor'], oi: 'oops'}]
+        },
+        {
+          name: 'an array-like op',
+          op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1}
+        },
+        {
+          name: 'ops with a path segment that is not a string',
+          op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}]
+        },
+        {
+          name: 'multi-component ops',
+          op: multiComponentOp
+        }
+      ].forEach(function(test) {
+        it('Rejects ' + test.name, function(done) {
+          doc.on('error', function(error) {
+            expectInvalidPathSegment(error);
+            done();
+          });
+          sendOp(test.op);
+        });
+      });
+
+      it('does not apply the valid components of a rejected multi-component op', function(done) {
+        doc.on('error', function() {
+          expect(doc.data).to.not.have.property('baz');
+          done();
+        });
+        sendOp(multiComponentOp);
+      });
+
+      it('leaves the doc usable after rejecting an op', function(done) {
+        doc.on('error', function() {
+          async.series([
+            doc.submitOp.bind(doc, [{p: ['baz'], oi: true}]),
+            doc.whenNothingPending.bind(doc),
+            function(next) {
+              expect(doc.data).to.eql({foo: 'bar', baz: true});
+              next();
+            }
+          ], done);
+        });
+        sendOp(multiComponentOp);
+      });
+    });
+
+    describe('locally submitted ops', function() {
+      var badOp = [{p: ['__proto__', 'polluted'], oi: 'oops'}];
+
+      it('rejects an op composed into a pending create', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'});
+        doc.submitOp(badOp, function(error) {
+          expectInvalidPathSegment(error);
+          done();
+        });
+      });
+
+      it('rejects an op without sending it to the server', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, function(error) {
+          if (error) return done(error);
+          var calledBack = false;
+          doc.submitOp(badOp, function(error) {
+            calledBack = true;
+            expectInvalidPathSegment(error);
+          });
+          // The server would only reject asynchronously, so calling back
+          // synchronously is how we know the op never left the client
+          expect(calledBack).to.equal(true);
+          done();
+        });
+      });
+
+      it('leaves the doc usable after rejecting an op', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        async.series([
+          doc.create.bind(doc, {foo: 'bar'}),
+          function(next) {
+            doc.submitOp(badOp, function(error) {
+              expect(error).to.be.instanceOf(Error);
+              next();
+            });
+          },
+          doc.submitOp.bind(doc, [{p: ['baz'], oi: true}]),
+          doc.whenNothingPending.bind(doc),
+          function(next) {
+            expect(doc.data).to.eql({foo: 'bar', baz: true});
+            next();
+          }
+        ], done);
+      });
+    });
   });
 
   describe('toSnapshot', function() {

package/test/client/snapshot-timestamp-request.js

@@ -208,6 +208,26 @@ describe('SnapshotTimestampRequest', function() {
       expect(fetch).to.throw(Error);
     });
 
+    [{}, null, '__proto__'].forEach(function(badValue) {
+      it('errors without reading the database if the collection is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshotByTimestamp(badValue, 'time-machine', null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid collection'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+
+      it('errors without reading the database if the id is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshotByTimestamp('books', badValue, null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid id'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+    });
+
     it('returns an empty snapshot if trying to fetch a non-existent document', function(done) {
       backend.connect().fetchSnapshotByTimestamp('books', 'does-not-exist', day1, function(error, snapshot) {
         if (error) return done(error);

package/test/client/snapshot-version-request.js

@@ -143,6 +143,26 @@ describe('SnapshotVersionRequest', function() {
       expect(fetch).to.throw(Error);
     });
 
+    [{}, null, '__proto__'].forEach(function(badValue) {
+      it('errors without reading the database if the collection is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshot(badValue, 'don-quixote', null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid collection'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+
+      it('errors without reading the database if the id is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshot('books', badValue, null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid id'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+    });
+
     it('errors if asking for a version that does not exist', function(done) {
       backend.connect().fetchSnapshot('books', 'don-quixote', 4, function(error, snapshot) {
         expect(error).to.be.ok;

package/test/lib-util.js

@@ -0,0 +1,56 @@
+var EventEmitter = require('../lib/emitter').EventEmitter;
+var util = require('../lib/util');
+var expect = require('chai').expect;
+
+describe('util.callbackOrEmit', function() {
+  var emitter;
+  var error;
+
+  beforeEach(function() {
+    emitter = new EventEmitter();
+    error = new Error('some error');
+  });
+
+  it('calls back synchronously with the error', function() {
+    var calledWith = 'not called';
+    util.callbackOrEmit(emitter, error, function(err) {
+      calledWith = err;
+    });
+    expect(calledWith).to.equal(error);
+  });
+
+  it('calls back synchronously when there is no error', function() {
+    var calledWith = 'not called';
+    util.callbackOrEmit(emitter, null, function(err) {
+      calledWith = err;
+    });
+    expect(calledWith).to.equal(null);
+  });
+
+  it('does not emit when a callback is provided', function() {
+    var emitted = false;
+    emitter.on('error', function() {
+      emitted = true;
+    });
+    util.callbackOrEmit(emitter, error, function() {});
+    expect(emitted).to.equal(false);
+  });
+
+  it('emits the error when there is no callback', function() {
+    var emittedWith = 'not emitted';
+    emitter.on('error', function(err) {
+      emittedWith = err;
+    });
+    util.callbackOrEmit(emitter, error);
+    expect(emittedWith).to.equal(error);
+  });
+
+  it('does nothing when there is no error and no callback', function() {
+    var emitted = false;
+    emitter.on('error', function() {
+      emitted = true;
+    });
+    util.callbackOrEmit(emitter, null);
+    expect(emitted).to.equal(false);
+  });
+});

package/test/ot.js

@@ -125,6 +125,68 @@ describe('ot', function() {
     });
   });
 
+  describe('json0 op validation', function() {
+    var snapshot;
+
+    beforeEach(function() {
+      snapshot = {v: 6, type: type.uri, data: {colour: 'blue'}};
+    });
+
+    afterEach(function() {
+      delete Object.prototype.polluted;
+    });
+
+    it('does not pollute the prototype through an array-like op', function() {
+      var op = {0: {p: ['__proto__', 'polluted'], oi: 'yes'}, length: 1};
+      var error = ot.apply(snapshot, {v: 6, op: op});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    it('does not pollute the prototype through an array-like op with a string length', function() {
+      var op = {0: {p: ['__proto__', 'polluted'], oi: 'yes'}, length: '1'};
+      var error = ot.apply(snapshot, {v: 6, op: op});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    it('does not pollute the prototype through a path segment that is not a string', function() {
+      var error = ot.apply(snapshot, {v: 6, op: [{p: [['__proto__'], 'polluted'], oi: 'yes'}]});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+      expect({}.polluted).to.equal(undefined);
+    });
+
+    ['__proto__', 'constructor'].forEach(function(badProp) {
+      it('rejects ' + badProp + ' as a path segment', function() {
+        var error = ot.apply(snapshot, {v: 6, op: [{p: [badProp, 'polluted'], oi: 'yes'}]});
+        expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+        expect(error.message).to.equal('Invalid path segment');
+        expect({}.polluted).to.equal(undefined);
+      });
+    });
+
+    it('returns an error for an op component that is not an object', function() {
+      var error;
+      expect(function() {
+        error = ot.apply(snapshot, {v: 6, op: [null]});
+      }).to.not.throw();
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('returns an error for an array-like op whose components are missing', function() {
+      var error = ot.apply(snapshot, {v: 6, op: {length: 1e9}});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('accepts an op that ot-json0 treats as a no-op', function() {
+      expect(ot.apply(snapshot, {v: 6, op: {p: ['colour'], oi: 'red'}})).equal();
+      expect(snapshot).to.eql({v: 7, type: type.uri, data: {colour: 'blue'}});
+    });
+  });
+
   describe('no-op', function() {
     it('works on existing docs', function() {
       var doc = {v: 6, type: type.uri, data: 'Hi'};
@@ -374,6 +436,55 @@ describe('ot', function() {
 
   describe('applyOps', function() {
     describe('with normalization turned on', function() {
+      afterEach(function() {
+        delete Object.prototype.polluted;
+      });
+
+      it('does not pollute the prototype while normalizing a legacy op', function() {
+        var snapshot = {
+          type: 'http://sharejs.org/types/JSONv0',
+          data: {title: 'Wee Free Men'}
+        };
+
+        var ops = [
+          {
+            v: 1,
+            op: [
+              {p: ['__proto__', 'polluted'], oi: 'yes'},
+              {p: ['title'], od: 'Wee Free Men', oi: 'Nation'}
+            ]
+          }
+        ];
+
+        var error = ot.applyOps(snapshot, ops, {
+          _normalizeLegacyJson0Ops: true
+        });
+        expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+        expect(error.message).to.equal('Invalid path segment');
+        expect({}.polluted).to.equal(undefined);
+      });
+
+      it('replays a legacy op that ot-json0 treats as a no-op', function() {
+        var snapshot = {
+          type: 'http://sharejs.org/types/JSONv0',
+          data: {title: 'Wee Free Men'}
+        };
+
+        var ops = [
+          {
+            v: 1,
+            op: {p: ['title'], od: 'Wee Free Men', oi: 'Nation'}
+          }
+        ];
+
+        var error = ot.applyOps(snapshot, ops, {
+          _normalizeLegacyJson0Ops: true
+        });
+        expect(error).to.be.undefined;
+        expect(snapshot.data).to.eql({title: 'Wee Free Men'});
+        expect(snapshot.v).to.equal(2);
+      });
+
       it('applies an op to a snapshot', function() {
         var snapshot = {
           type: 'http://sharejs.org/types/JSONv0',

package/test/projections.js

@@ -385,4 +385,33 @@ describe('projection utility methods', function() {
       );
     });
   });
+
+  describe('non-truthy field values', function() {
+    it('does not treat a false field as a projected field', function() {
+      var op = {op: [{p: ['x', 'y'], oi: 'nope'}]};
+      expect(projections.isOpAllowed(null, {x: false}, op)).equal(false);
+      projections.projectOp({x: false}, op);
+      expect(op).eql({op: []});
+    });
+
+    it('does not treat a false field as an allowed snapshot field', function() {
+      expect(projections.isSnapshotAllowed({x: false}, {type: type, data: {x: 1}})).equal(false);
+    });
+  });
+
+  describe('field names inherited from Object.prototype', function() {
+    ['__proto__', 'constructor', 'toString'].forEach(function(badProp) {
+      it('does not treat ' + badProp + ' as a projected field', function() {
+        var op = {op: [{p: [badProp, 'x'], oi: 'oops'}]};
+        expect(projections.isOpAllowed(null, {x: true}, op)).equal(false);
+        projections.projectOp({x: true}, op);
+        expect(op).eql({op: []});
+      });
+
+      it('does not treat ' + badProp + ' as an allowed snapshot field', function() {
+        var data = JSON.parse('{"' + badProp + '": "oops"}');
+        expect(projections.isSnapshotAllowed({x: true}, {type: type, data: data})).equal(false);
+      });
+    });
+  });
 });