Fix initialization when Object.prototype is extended or polluted (f…

…ixes #262)
csstree · Oct 13, 2023 · 26a64c7 · 26a64c7
1 parent d56a79a
commit 26a64c7
Show file tree

Hide file tree

Showing 13 changed files with 56 additions and 60 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -5,8 +5,7 @@ on:
     pull_request:
 
 env:
-    PRIMARY_NODEJS_VERSION: 16
-    REPORTER: "min"
+    PRIMARY_NODEJS_VERSION: 18
 
 jobs:
     lint:
@@ -33,7 +32,7 @@ jobs:
                 node-version: ${{ env.PRIMARY_NODEJS_VERSION }}
                 cache: "npm"
             - run: npm ci
-            - run: npm run bundle-and-test
+            - run: npm run bundle-and-test -- -- --reporter min
 
     unit-tests:
         name: Unit tests
@@ -47,6 +46,8 @@ jobs:
                     - 12.20.0
                     - 14.13.0
                     - 16
+                    - 18
+                    - 20
 
         steps:
             - uses: actions/checkout@v2
@@ -56,10 +57,9 @@ jobs:
                 node-version: ${{ matrix.node_version }}
                 cache: "npm"
             - run: npm ci
-            - run: npm run test
+            - run: npm run test -- --reporter min
               if: ${{ matrix.node_version != '10' }}
-            - run: npm run esm-to-cjs-and-test
-
+            - run: npm run esm-to-cjs-and-test -- -- --reporter min
             - run: npm run coverage
               if: ${{ matrix.node_version == env.PRIMARY_NODEJS_VERSION }}
             - name: Coveralls parallel

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@
 - Bumped `mdn/data` to `2.1.0`
 - Added `<dashed-ident>` to generic types
 - Added `TokenStream#lookupTypeNonSC()` method
+- Fixed initialization when `Object.prototype` is extended or polluted (#262)
 - Changed `parseWithFallback()` to rollback `tokenIndex` before calling a fallback
 - Changed `Ratio` parsing:
     - Left and right parts contain nodes instead of strings

diff --git a/lib/__tests/definition-syntax-match.js b/lib/__tests/definition-syntax-match.js
@@ -48,19 +48,19 @@ function createSyntaxTest(testName, test) {
         ? { types: { ...defaultTypes }, properties: { ...defaultProperties} }
         : { types: {}, properties: {} };
 
-    for (const name in genericSyntaxes) {
+    for (const name of Object.keys(genericSyntaxes)) {
         syntaxes.types[name] = {
             match: buildMatchGraph(genericSyntaxes[name])
         };
     }
 
-    for (const name in test.types) {
+    for (const name of Object.keys(test.types || {})) {
         syntaxes.types[name] = {
             match: buildMatchGraph(test.types[name])
         };
     }
 
-    for (const name in test.properties) {
+    for (const name of Object.keys(test.properties || {})) {
         syntaxes.properties[name] = {
             match: buildMatchGraph(test.properties[name])
         };

diff --git a/lib/__tests/fixture/definition-syntax-match.js b/lib/__tests/fixture/definition-syntax-match.js
@@ -5,11 +5,9 @@ import { JsonLocator } from '../helpers/JsonLocator.js';
 const __dirname = 'fixtures/definition-syntax-match';
 
 export function forEachTest(factory) {
-    for (const filename in tests) {
-        const file = tests[filename];
-
-        for (const key in file) {
-            factory(key, file[key]);
+    for (const file of Object.values(tests)) {
+        for (const [key, test] of Object.entries(file)) {
+            factory(key, test);
         }
     };
 }

diff --git a/lib/__tests/fixture/definition-syntax.js b/lib/__tests/fixture/definition-syntax.js
@@ -6,11 +6,8 @@ import { JsonLocator } from '../helpers/JsonLocator.js';
 const __dirname = 'fixtures/definition-syntax';
 
 export function forEachTest(factory) {
-    for (const filename in tests) {
-        const file = tests[filename];
-
-        for (const key in file) {
-            const test = file[key];
+    for (const file of Object.values(tests)) {
+        for (const test of Object.values(file)) {
             const syntax = test.syntax;
             const lexer = test.lexer ? createLexer(test.lexer) : defaultLexer;
 
@@ -36,9 +33,7 @@ export function forEachTest(factory) {
 }
 
 export function forEachAtrulePreludeTest(factory) {
-    for (const atruleName in atruleTests) {
-        const testset = atruleTests[atruleName];
-
+    for (const [atruleName, testset] of Object.entries(atruleTests)) {
         if (testset.prelude) {
             const test = testset.prelude;
             for (const field in test) {
@@ -62,13 +57,10 @@ export function forEachAtrulePreludeTest(factory) {
 }
 
 export function forEachAtruleDescriptorTest(factory) {
-    for (const atruleName in atruleTests) {
-        const testset = atruleTests[atruleName];
-
+    for (const [atruleName, testset] of Object.entries(atruleTests)) {
         if (testset.descriptors) {
-            for (const descriptorName in testset.descriptors) {
-                const test = testset.descriptors[descriptorName];
-                for (const field in test) {
+            for (const [descriptorName, test] of Object.entries(testset.descriptors)) {
+                for (const field of Object.keys(test)) {
                     if (field !== 'valid' && field !== 'invalid') {
                         continue;
                     }

diff --git a/lib/__tests/fixture/tokenize.js b/lib/__tests/fixture/tokenize.js
@@ -20,9 +20,7 @@ function processTests(tests, key, type, locator) {
 }
 
 export function forEachTest(testType, factory) {
-    for (const filename in tests) {
-        const file = tests[filename];
-
+    for (const file of Object.values(tests)) {
         Object.keys(file[testType]).forEach(key => factory(
             file[testType][key].name,
             file[testType][key].value,

diff --git a/lib/__tests/helpers/setup.js b/lib/__tests/helpers/setup.js
@@ -0,0 +1,8 @@
+// Guard to mitigate the risk of reading non-own properties,
+// which can be a potential issue when working with dictionaries
+Object.defineProperty(Object.prototype, '__proto_pollute__', {
+    enumerable: true,
+    get() {
+        throw new Error('Attempted to read a non-own property');
+    }
+});
diff --git a/lib/data.js b/lib/data.js
@@ -6,20 +6,20 @@ const mdnAtrules = require('mdn-data/css/at-rules.json');
 const mdnProperties = require('mdn-data/css/properties.json');
 const mdnSyntaxes = require('mdn-data/css/syntaxes.json');
 
+const hasOwn = Object.hasOwn || ((object, property) => Object.prototype.hasOwnProperty.call(object, property));
 const extendSyntax = /^\s*\|\s*/;
 
 function preprocessAtrules(dict) {
     const result = Object.create(null);
 
-    for (const atruleName in dict) {
-        const atrule = dict[atruleName];
+    for (const [atruleName, atrule] of Object.entries(dict)) {
         let descriptors = null;
 
         if (atrule.descriptors) {
             descriptors = Object.create(null);
 
-            for (const descriptor in atrule.descriptors) {
-                descriptors[descriptor] = atrule.descriptors[descriptor].syntax;
+            for (const [name, descriptor] of Object.entries(atrule.descriptors)) {
+                descriptors[name] = descriptor.syntax;
             }
         }
 
@@ -33,16 +33,18 @@ function preprocessAtrules(dict) {
 }
 
 function patchDictionary(dict, patchDict) {
-    const result = {};
+    const result = Object.create(null);
 
     // copy all syntaxes for an original dict
-    for (const key in dict) {
-        result[key] = dict[key].syntax || dict[key];
+    for (const [key, value] of Object.entries(dict)) {
+        if (value) {
+            result[key] = value.syntax || value;
+        }
     }
 
     // apply a patch
-    for (const key in patchDict) {
-        if (key in dict) {
+    for (const key of Object.keys(patchDict)) {
+        if (hasOwn(dict, key)) {
             if (patchDict[key].syntax) {
                 result[key] = extendSyntax.test(patchDict[key].syntax)
                     ? result[key] + ' ' + patchDict[key].syntax.trim()
@@ -80,10 +82,8 @@ function patchAtrules(dict, patchDict) {
     }
 
     // apply a patch
-    for (const key in patchDict) {
-        if (patchDict[key] && !hasOwnProperty.call(dict, key)) {
-            const atrulePatch = patchDict[key] || {};
-
+    for (const [key, atrulePatch] of Object.entries(patchDict)) {
+        if (atrulePatch && !hasOwn(dict, key)) {
             result[key] = {
                 prelude: atrulePatch.prelude || null,
                 descriptors: atrulePatch.descriptors && patchDictionary({}, atrulePatch.descriptors)

diff --git a/lib/generator/create.js b/lib/generator/create.js
@@ -32,8 +32,7 @@ function processChunk(chunk) {
 export function createGenerator(config) {
     const types = new Map();
 
-    for (let name in config.node) {
-        const item = config.node[name];
+    for (let [name, item] of Object.entries(config.node)) {
         const fn = item.generate || item;
 
         if (typeof fn === 'function') {

diff --git a/lib/lexer/Lexer.js b/lib/lexer/Lexer.js
@@ -110,8 +110,8 @@ export class Lexer {
             }
 
             if (config.types) {
-                for (const name in config.types) {
-                    this.addType_(name, config.types[name]);
+                for (const [name, type] of Object.entries(config.types)) {
+                    this.addType_(name, type);
                 }
             }
 
@@ -123,14 +123,14 @@ export class Lexer {
             }
 
             if (config.atrules) {
-                for (const name in config.atrules) {
-                    this.addAtrule_(name, config.atrules[name]);
+                for (const [name, atrule] of Object.entries(config.atrules)) {
+                    this.addAtrule_(name, atrule);
                 }
             }
 
             if (config.properties) {
-                for (const name in config.properties) {
-                    this.addProperty_(name, config.properties[name]);
+                for (const [name, property] of Object.entries(config.properties)) {
+                    this.addProperty_(name, property);
                 }
             }
         }

diff --git a/lib/parser/create.js b/lib/parser/create.js
@@ -60,14 +60,14 @@ function processConfig(config) {
         node: fetchParseValues(config.node)
     };
 
-    for (const name in config.parseContext) {
-        switch (typeof config.parseContext[name]) {
+    for (const [name, context] of Object.entries(config.parseContext)) {
+        switch (typeof context) {
             case 'function':
-                parseConfig.context[name] = config.parseContext[name];
+                parseConfig.context[name] = context;
                 break;
 
             case 'string':
-                parseConfig.context[name] = createParseContext(config.parseContext[name]);
+                parseConfig.context[name] = createParseContext(context);
                 break;
         }
     }

diff --git a/lib/utils/clone.js b/lib/utils/clone.js
@@ -3,7 +3,7 @@ import { List } from './List.js';
 export function clone(node) {
     const result = {};
 
-    for (const key in node) {
+    for (const key of Object.keys(node)) {
         let value = node[key];
 
         if (value) {

diff --git a/package.json b/package.json
@@ -92,9 +92,9 @@
     "lint-and-test": "npm run lint && npm test",
     "update:docs": "node scripts/update-docs",
     "review:syntax-patch": "node scripts/review-syntax-patch",
-    "test": "mocha lib/__tests --reporter ${REPORTER:-progress}",
-    "test:cjs": "mocha cjs/__tests --reporter ${REPORTER:-progress}",
-    "test:dist": "mocha dist/__tests --reporter ${REPORTER:-progress}",
+    "test": "mocha lib/__tests --require lib/__tests/helpers/setup.js --reporter progress",
+    "test:cjs": "mocha cjs/__tests --require lib/__tests/helpers/setup.js --reporter progress",
+    "test:dist": "mocha dist/__tests --reporter progress",
     "coverage": "c8 --exclude lib/__tests --reporter=lcovonly npm test",
     "prepublishOnly": "npm run lint-and-test && npm run build-and-test",
     "hydrogen": "node --trace-hydrogen --trace-phase=Z --trace-deopt --code-comments --hydrogen-track-positions --redirect-code-traces --redirect-code-traces-to=code.asm --trace_hydrogen_file=code.cfg --print-opt-code bin/parse --stat -o /dev/null"