Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[lint] Remove no-prototype-builtins #1259

Merged
merged 2 commits into from
Sep 8, 2022
Merged

Conversation

dayo09
Copy link
Contributor

@dayo09 dayo09 commented Sep 6, 2022

This commit adds "no-prototype-builtins" rule and
fixes errors accordingly.

ONE-vscode-DCO-1.0-Signed-off-by: dayo09 [email protected]


For #1253

Remove no-prototype-builtins

Reference

https://eslint.org/docs/latest/rules/no-prototype-builtins

In ECMAScript 5.1, Object.create was added, which enables the creation of objects with a specified [[Prototype]]. Object.create(null) is a common pattern used to create objects that will be used as a Map. This can lead to errors when it is assumed that objects will have properties from Object.prototype. This rule prevents calling some Object.prototype methods directly from an object.

Additionally, objects can have properties that shadow the builtins on Object.prototype, potentially causing unintended behavior or denial-of-service security vulnerabilities. For example, it would be unsafe for a webserver to parse JSON input from a client and call hasOwnProperty directly on the resulting object, because a malicious client could send a JSON value like {"hasOwnProperty": 1} and cause the server to crash.

To avoid subtle bugs like this, it’s better to always call these methods from Object.prototype. For example, foo.hasOwnProperty("bar") should be replaced with Object.prototype.hasOwnProperty.call(foo, "bar").

Example

Examples of incorrect code for this rule:
var hasBarProperty = foo.hasOwnProperty("bar");
....
Examples of correct code for this rule:
var hasBarProperty = Object.prototype.hasOwnProperty.call(foo, "bar");

@dayo09 dayo09 added DRAFT Something like playground and removed DRAFT Something like playground labels Sep 6, 2022
@dayo09 dayo09 requested review from seanshpark and a team September 6, 2022 06:09
@dayo09 dayo09 added the 2 approvals 2 approvals required to be merged label Sep 6, 2022
seanshpark
seanshpark previously approved these changes Sep 6, 2022
Copy link
Contributor

@seanshpark seanshpark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thank you!

@dayo09 dayo09 requested a review from a team September 6, 2022 07:04
@dayo09
Copy link
Contributor Author

dayo09 commented Sep 6, 2022

@Samsung/one-vscode PTAL :-D

mhs4670go
mhs4670go previously approved these changes Sep 7, 2022
Copy link
Contributor

@mhs4670go mhs4670go left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mhs4670go
Copy link
Contributor

it has some confilct.

.eslintrc.json Outdated Show resolved Hide resolved
@dayo09 dayo09 dismissed stale reviews from mhs4670go and seanshpark via 7aa2a5b September 7, 2022 09:46
This commit adds "no-prototype-builtins" rule and
fixes errors accordingly.

ONE-vscode-DCO-1.0-Signed-off-by: dayo09 <[email protected]>
ONE-vscode-DCO-1.0-Signed-off-by: dayo09 <[email protected]>
@dayo09
Copy link
Contributor Author

dayo09 commented Sep 7, 2022

@mhs4670go @seanshpark It's rebased. PTAL :-D

@mhs4670go mhs4670go merged commit f2a75f0 into Samsung:main Sep 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2 approvals 2 approvals required to be merged
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants