shelving 1.267.1 → 1.267.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.267.1",
+	"version": "1.267.2",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",

package/schema/StringSchema.js

@@ -31,12 +31,15 @@ export class StringSchema extends Schema {
         if (typeof str !== "string")
             throw value ? `Must be ${this.one}` : "Required";
         const sane = this.sanitize(str);
+        // Enforce `max` before running `match`, so an over-length string is rejected without ever being handed to
+        // the (potentially expensive) regex — a length cap can't shield the pattern otherwise. `min` stays after
+        // `match` to preserve the existing "Invalid" precedence for short-but-malformed values.
+        if (sane.length > this.max)
+            throw `Maximum ${this.max} characters`;
         if (this.match && !this.match.test(sane))
             throw str.length ? `Invalid ${this.one}` : "Required";
         if (sane.length < this.min)
             throw str.length ? `Minimum ${this.min} characters` : "Required";
-        if (sane.length > this.max)
-            throw `Maximum ${this.max} characters`;
         return sane;
     }
     /**

package/util/validate.js

@@ -124,7 +124,10 @@ export function validateArray(unsafeArray, validator) {
  */
 export function validateDictionary(unsafeDictionary, validator) {
     let changed = false;
-    const safeDictionary = {};
+    // Null-prototype accumulator: an untrusted `"__proto__"` key (or `"constructor"`) then becomes an inert own
+    // property instead of invoking the inherited `__proto__` setter, so a crafted `{ "__proto__": … }` input can't
+    // reassign the returned dictionary's prototype, and the entry stays enumerable so `min`/`max` counts are correct.
+    const safeDictionary = Object.create(null);
     const messages = [];
     for (const [key, unsafeValue] of getDictionaryItems(unsafeDictionary)) {
         try {