Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: avoid use of prototype attributes in keystore queries #660

Merged
merged 1 commit into from
Feb 7, 2024

Conversation

pnappa
Copy link
Contributor

@pnappa pnappa commented Feb 7, 2024

When this library is run under environments which prohibit use of the deprecated __proto__ getter/setter, it may cause a crash due to reading from the proto property. An example scenario is when the --disable-proto=throw flag is used for NodeJS.

To disable consideration of the prototype, __proto__, and constructor fields fields when hashing, the respectType flag can be toggled off. This is not a problem for this library, as we are querying only for the existence of a object created via an object literal, which will have these properties all the same anyway.

When this library is run under environments which prohibit use of the
deprecated __proto__ getter/setter, it may cause a crash due to reading
from the __proto__ property. An example scenario is when the
`--disable-proto=throw` flag is used for NodeJS.

To disable consideration of the `prototype`, `__proto__`, and
`constructor` fields fields when hashing, the `respectType` flag can be
toggled off. This is not a problem for this library, as we are querying
only for the existence of a object created via an object literal, which
will have these properties all the same anyway.
@pnappa
Copy link
Contributor Author

pnappa commented Feb 7, 2024

If you're curious as to why I'm using that Node flag, I'm looking to migrate a codebase to Deno (which has removed the __proto__ feature), and it is necessary to complain very loud about potential scenarios where it would lead to silent incompatibility. :)

@panva panva changed the title Ignore __proto__ parameters for object hash equality. refactor: avoid use of prototype attributes in keystore queries Feb 7, 2024
@panva panva merged commit 47a549c into panva:main Feb 7, 2024
@panva
Copy link
Owner

panva commented Feb 7, 2024

@pnappa thank you Patrick, though please note that this is a Node.js module and compatibility with Deno or other runtimes is not a goal. On the other hand https://github.com/panva/oauth4webapi is built using just Web runtime APIs, it is however a much lower level API.

@github-actions github-actions bot locked and limited conversation to collaborators May 13, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants