fix: do not allow invalid hazardous keys in query

__tests__/parseQuery.spec.ts

@@ -85,4 +85,15 @@ describe('parseQuery', () => {
 
     expect('decoding "%"').toHaveBeenWarnedTimes(1)
   })
+
+  it('keep prototype', () => {
+    const query = parseQuery('__proto__=1')
+    expect(query.__proto__).toEqual(Object.prototype)
+    expect(query.constructor).toEqual(Object)
+  })
+
+  it('keep build-in methods', () => {
+    const query = parseQuery('toString=1')
+    expect(query.toString).toEqual(Object.prototype.toString)
+  })
 })

src/query.ts

@@ -33,6 +33,14 @@ export type LocationQueryRaw = Record<
   LocationQueryValueRaw | LocationQueryValueRaw[]
 >
 
+/**
+ * Do not allow invalid hazardous query keys
+ */
+function isAllowedQueryKey(key: string): boolean {
+  const keysBlockList = ['__proto__', 'constructor', 'prototype']
+  return !keysBlockList.includes(key) && !Object.prototype.hasOwnProperty(key)
+}
+
 /**
  * Transforms a queryString into a {@link LocationQuery} object. Accept both, a
  * version with the leading `?` and without Should work as URLSearchParams
@@ -55,6 +63,9 @@ export function parseQuery(search: string): LocationQuery {
     // allow the = character
     let eqPos = searchParam.indexOf('=')
     let key = decode(eqPos < 0 ? searchParam : searchParam.slice(0, eqPos))
+    if (!isAllowedQueryKey(key)) {
+      continue
+    }
     let value = eqPos < 0 ? null : decode(searchParam.slice(eqPos + 1))
 
     if (key in query) {