Replace empty literal object initializer with Object method to avoid prototype pollution.

diff --git a/src/lib/account/refresh.ts b/src/lib/account/refresh.ts
index d416c20a3c9e01ab568ffaa14f3f7e67c24c5fa0..9172309562cbe8637e75cf65ff516aec535ed907 100644 (file)
--- a/src/lib/account/refresh.ts
+++ b/src/lib/account/refresh.ts
@@ -46,7 +46,7 @@ export async function _refresh (account: Account, rpc: unknown): Promise<void> {
        if (!('contents' in resConfirmedFrontierBlockInfo) || resConfirmedFrontierBlockInfo.contents == null || typeof resConfirmedFrontierBlockInfo.contents !== 'object') {
                throw new Error('Confirmed frontier block info contents not found')
        }
-       const confirmedFrontierContents: Record<string, string> = {}
+       const confirmedFrontierContents: Record<string, string> = Object.create(null)
        for (const [k, v] of Object.entries(resConfirmedFrontierBlockInfo.contents)) {
                confirmedFrontierContents[k] = v
        }
@@ -83,7 +83,7 @@ export async function _refresh (account: Account, rpc: unknown): Promise<void> {
        if (!('contents' in resFrontierBlockInfo) || resFrontierBlockInfo.contents == null || typeof resFrontierBlockInfo.contents !== 'object') {
                throw new Error('Frontier block info contents not found')
        }
-       const frontierContents: Record<string, string> = {}
+       const frontierContents: Record<string, string> = Object.create(null)
        for (const [k, v] of Object.entries(resFrontierBlockInfo.contents)) {
                frontierContents[k] = v
        }

diff --git a/src/lib/database.ts b/src/lib/database.ts
index 09c39d3d66d8d17b30c0fb616aa6c505e9e76c05..571da1f65977dc4810ac2cf204051ca6229cb392 100644 (file)
--- a/src/lib/database.ts
+++ b/src/lib/database.ts
@@ -107,7 +107,7 @@ export class Database {
                return new Promise((resolve, reject) => {
                        const requests = ids.map(id => db.get(id))
                        transaction.oncomplete = (event) => {
-                               const results: Record<string, T> = {}
+                               const results: Record<string, T> = Object.create(null)
                                for (const request of requests) {
                                        if (request?.result?.id != null) {
                                                results[request.result.id] = request.error ?? request.result
@@ -139,7 +139,7 @@ export class Database {
                                } else if (request.result == null) {
                                        reject('getAll request failed')
                                } else {
-                                       const results: Record<string, T> = {}
+                                       const results: Record<string, T> = Object.create(null)
                                        for (const result of request.result) {
                                                results[result.id] = request.error ?? result
                                        }

diff --git a/src/lib/rpc/accounts_balances.ts b/src/lib/rpc/accounts_balances.ts
index 3ab1fc8ea6ad45291fd9f6cee9c56011f7d02b43..ebc90e096c9c002c83092b870e4a17106871d2a2 100644 (file)
--- a/src/lib/rpc/accounts_balances.ts
+++ b/src/lib/rpc/accounts_balances.ts
@@ -16,7 +16,7 @@ type AccountsBalancesResponse = {
 
 export function accounts_balances (body: unknown): AccountsBalancesResponse {
        if (body != null && typeof body === 'object') {
-               const response: AccountsBalancesResponse = {}
+               const response: AccountsBalancesResponse = Object.create(null)
 
                if ('errors' in body && body.errors != null && typeof body.errors === 'object') {
                        for (const [address, error] of Object.entries(body.errors) as [string, unknown][]) {
@@ -28,7 +28,7 @@ export function accounts_balances (body: unknown): AccountsBalancesResponse {
                                                throw new RpcError(error)
                                        }
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[address] = err?.message
                                }
                        }
@@ -43,10 +43,10 @@ export function accounts_balances (body: unknown): AccountsBalancesResponse {
                                        if (data == null || typeof data !== 'object') {
                                                throw new RpcError('Invalid account balance data')
                                        }
-                                       response.balances ??= {}
+                                       response.balances ??= Object.create(null)
                                        response.balances[address] = account_balance(data)
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[address] ??= err?.message
                                }
                        }

diff --git a/src/lib/rpc/accounts_frontiers.ts b/src/lib/rpc/accounts_frontiers.ts
index 56c6955019f8041472fbeeaafb886415f4bbdc82..5b84d45a8dc7e072b3a63a12b7ec84466dac593f 100644 (file)
--- a/src/lib/rpc/accounts_frontiers.ts
+++ b/src/lib/rpc/accounts_frontiers.ts
@@ -15,7 +15,7 @@ export type AccountsFrontiersResponse = {
 }
 
 export function accounts_frontiers (body: unknown): AccountsFrontiersResponse {
-       const response: AccountsFrontiersResponse = {}
+       const response: AccountsFrontiersResponse = Object.create(null)
        if (body == null || typeof body !== 'object') {
                return response
        }
@@ -30,11 +30,11 @@ export function accounts_frontiers (body: unknown): AccountsFrontiersResponse {
                                                throw new RpcError('Invalid account address')
                                        }
                                        if (hex.is(frontier, 64)) {
-                                               response.frontiers ??= {}
-                                               response.frontiers[address] = frontier
+                                               response.frontiers ??= Object.create(null)
+                                                                                               response.frontiers[address] = frontier
                                        }
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[address] = err?.message
                                }
                        }
@@ -52,7 +52,7 @@ export function accounts_frontiers (body: unknown): AccountsFrontiersResponse {
                                                throw new Error(error)
                                        }
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[address] = err?.message
                                }
                        }

diff --git a/src/lib/rpc/blocks_info.ts b/src/lib/rpc/blocks_info.ts
index 12de6e5b3a0a91a73eaaf9a98eec8d42edbde8cb..2260bffe189d0e57ca5974b2fa98b9013ed7a510 100644 (file)
--- a/src/lib/rpc/blocks_info.ts
+++ b/src/lib/rpc/blocks_info.ts
@@ -17,7 +17,7 @@ export type BlocksInfoResponse = {
 
 export function blocks_info (body: unknown): BlocksInfoResponse {
        if (body != null && typeof body === 'object') {
-               const response: BlocksInfoResponse = {}
+               const response: BlocksInfoResponse = Object.create(null)
 
                if ('errors' in body && body.errors != null && typeof body.errors === 'object') {
                        for (const [hash, error] of Object.entries(body.errors) as [string, unknown][]) {
@@ -28,7 +28,7 @@ export function blocks_info (body: unknown): BlocksInfoResponse {
                                                throw new Error('Invalid blocks_info error')
                                        }
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[hash] = err?.message
                                }
                        }
@@ -38,13 +38,13 @@ export function blocks_info (body: unknown): BlocksInfoResponse {
                        for (const [hash, data] of Object.entries(body.blocks) as [string, unknown][]) {
                                try {
                                        if (hex.is(hash)) {
-                                               response.blocks ??= {}
+                                               response.blocks ??= Object.create(null)
                                                response.blocks[hash] = block_info(data)
                                        } else {
                                                throw new Error('Invalid blocks_info hash')
                                        }
                                } catch (err: any) {
-                                       response.errors ??= {}
+                                       response.errors ??= Object.create(null)
                                        response.errors[hash] ??= err?.message
                                }
                        }

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index c5752603595013de3401e7e74f9400f19b681aa1..cce418173cade79f718d2f680d4d6ff26a18c36f 100644 (file)
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -82,7 +82,7 @@ const listener = (event: MessageEvent<any>): void => {
                        }
                })
                .then((result: Record<string, boolean | number | string | ArrayBuffer> | void) => {
-                       result ??= {}
+                       result ??= Object.create(null)
                        const transfer: ArrayBuffer[] = []
                        if (result) {
                                for (const r of Object.values(result)) {
@@ -197,7 +197,7 @@ function derive (index?: number | Uint32Array): Promise<Record<string, number |
                }
                return Promise.all(promises)
                        .then(results => {
-                               const data: Record<string, ArrayBuffer> = {}
+                               const data: Record<string, ArrayBuffer> = Object.create(null)
                                for (const result of results) {
                                        data[result.index] = result.publicKey
                                }

diff --git a/src/lib/wallet/create.ts b/src/lib/wallet/create.ts
index cf6fb52cc0904376f307760afb5bbd728770fd8a..358f7d8eaa33f613f69ae8954e7f57963401722b 100644 (file)
--- a/src/lib/wallet/create.ts
+++ b/src/lib/wallet/create.ts
@@ -10,7 +10,7 @@ import { Wallet } from '../wallet'
 export async function _create (wallet: Wallet, vault: Vault, password?: string, mnemonicSalt?: string): Promise<{ mnemonic?: ArrayBuffer, seed?: ArrayBuffer }>
 export async function _create (wallet: Wallet, vault: Vault, password: unknown, mnemonicSalt?: unknown): Promise<{ mnemonic?: ArrayBuffer, seed?: ArrayBuffer }> {
        try {
-               const result: { mnemonic?: ArrayBuffer, seed?: ArrayBuffer } = {}
+               const result: { mnemonic?: ArrayBuffer, seed?: ArrayBuffer } = Object.create(null)
                const record = {
                        id: wallet.id,
                        type: wallet.type,

diff --git a/test/GLOBALS.mjs b/test/GLOBALS.mjs
index 17acc98e39e60199c55f58eaeefc5f44b3df078e..16b6f0f8ac616c5f45f08625f0a22ea660270f20 100644 (file)
--- a/test/GLOBALS.mjs
+++ b/test/GLOBALS.mjs
@@ -13,14 +13,14 @@ const auth = env.LIBNEMO_RPC_AUTHORIZATION
 export const rpc = new Rpc(url, auth)
 
 if (globalThis.sessionStorage == null) {
-       let _sessionStorage = {}
+       let _sessionStorage = Object.create(null)
        Object.defineProperty(globalThis, 'sessionStorage', {
                value: {
                        length: Object.entries(_sessionStorage).length,
                        setItem: (key, value) => _sessionStorage[key] = value,
                        getItem: (key) => _sessionStorage[key],
                        removeItem: (key) => delete _sessionStorage[key],
-                       clear: () => _sessionStorage = {}
+                       clear: () => _sessionStorage = Object.create(null)
                },
                configurable: true,
                enumerable: true