fix: skip flattening spread object with __proto__

packages/babel-plugin-transform-react-jsx/src/create-plugin.ts

@@ -39,6 +39,15 @@ const get = (pass: PluginPass, name: string) =>
 const set = (pass: PluginPass, name: string, v: any) =>
   pass.set(`@babel/plugin-react-jsx/${name}`, v);
 
+function hasProto(node: t.ObjectExpression) {
+  return node.properties.some(
+    value =>
+      t.isObjectProperty(value, { computed: false }) &&
+      (t.isIdentifier(value.key, { name: "__proto__" }) ||
+        t.isStringLiteral(value.key, { value: "__proto__" })),
+  );
+}
+
 export interface Options {
   filter?: (node: t.Node, pass: PluginPass) => boolean;
   importSource?: string;
@@ -422,7 +431,7 @@ You can set \`throwIfNamespace: false\` to bypass this warning.`,
       if (t.isJSXSpreadAttribute(attribute.node)) {
         const arg = attribute.node.argument;
         // Collect properties into props array if spreading object expression
-        if (t.isObjectExpression(arg)) {
+        if (t.isObjectExpression(arg) && !hasProto(arg)) {
           array.push(...arg.properties);
         } else {
           array.push(t.spreadElement(arg));

packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/input.js

@@ -5,3 +5,7 @@
 <img alt="" {...{src, title}} />;
 
 <blockquote {...{cite}}>{items}</blockquote>;
+
+<pre {...{["__proto__"]: null }}></pre>;
+
+<code {...{[__proto__]: null }}></code>;

packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/flattens-spread/output.mjs

@@ -22,3 +22,13 @@ _jsx("blockquote", {
   cite,
   children: items
 });
+
+/*#__PURE__*/
+_jsx("pre", {
+  ["__proto__"]: null
+});
+
+/*#__PURE__*/
+_jsx("code", {
+  [__proto__]: null
+});

packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/input.js

@@ -0,0 +1,7 @@
+var __proto__ = null;
+
+<p {...{__proto__: null}}>text</p>;
+
+<div {...{"__proto__": null}}>{contents}</div>;
+
+<img alt="" {...{__proto__}} />;

packages/babel-plugin-transform-react-jsx/test/fixtures/react-automatic/handle-spread-with-proto/output.mjs

@@ -0,0 +1,24 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+var __proto__ = null;
+
+/*#__PURE__*/
+_jsx("p", { ...{
+    __proto__: null
+  },
+  children: "text"
+});
+
+/*#__PURE__*/
+_jsx("div", { ...{
+    "__proto__": null
+  },
+  children: contents
+});
+
+/*#__PURE__*/
+_jsx("img", {
+  alt: "",
+  ...{
+    __proto__
+  }
+});

packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/input.js

@@ -5,3 +5,7 @@
 <img alt="" {...{src, title}} />;
 
 <blockquote {...{cite}}>{items}</blockquote>;
+
+<pre {...{["__proto__"]: null }}></pre>;
+
+<code {...{[__proto__]: null }}></code>;

packages/babel-plugin-transform-react-jsx/test/fixtures/react/flattens-spread/output.js

@@ -15,3 +15,13 @@ React.createElement("img", {
 React.createElement("blockquote", {
   cite
 }, items);
+
+/*#__PURE__*/
+React.createElement("pre", {
+  ["__proto__"]: null
+});
+
+/*#__PURE__*/
+React.createElement("code", {
+  [__proto__]: null
+});

packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/input.js

@@ -0,0 +1,7 @@
+var __proto__ = null;
+
+<p {...{__proto__: null}}>text</p>;
+
+<div {...{"__proto__": null}}>{contents}</div>;
+
+<img alt="" {...{__proto__}} />;

packages/babel-plugin-transform-react-jsx/test/fixtures/react/handle-spread-with-proto/output.js

@@ -0,0 +1,18 @@
+var __proto__ = null;
+
+/*#__PURE__*/
+React.createElement("p", {
+  __proto__: null
+}, "text");
+
+/*#__PURE__*/
+React.createElement("div", {
+  "__proto__": null
+}, contents);
+
+/*#__PURE__*/
+React.createElement("img", babelHelpers.extends({
+  alt: ""
+}, {
+  __proto__
+}));