From: Chris Duncan Date: Sun, 9 Aug 2026 14:24:41 +0000 (-0700) Subject: Replace empty literal object initializer with Object method to avoid prototype pollution. X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=7d900364b83b395f6f864194277a54e3eed64504;p=libnemo.git Replace empty literal object initializer with Object method to avoid prototype pollution. --- diff --git a/src/lib/account/refresh.ts b/src/lib/account/refresh.ts index d416c20..9172309 100644 --- a/src/lib/account/refresh.ts +++ b/src/lib/account/refresh.ts @@ -46,7 +46,7 @@ export async function _refresh (account: Account, rpc: unknown): Promise { if (!('contents' in resConfirmedFrontierBlockInfo) || resConfirmedFrontierBlockInfo.contents == null || typeof resConfirmedFrontierBlockInfo.contents !== 'object') { throw new Error('Confirmed frontier block info contents not found') } - const confirmedFrontierContents: Record = {} + const confirmedFrontierContents: Record = Object.create(null) for (const [k, v] of Object.entries(resConfirmedFrontierBlockInfo.contents)) { confirmedFrontierContents[k] = v } @@ -83,7 +83,7 @@ export async function _refresh (account: Account, rpc: unknown): Promise { if (!('contents' in resFrontierBlockInfo) || resFrontierBlockInfo.contents == null || typeof resFrontierBlockInfo.contents !== 'object') { throw new Error('Frontier block info contents not found') } - const frontierContents: Record = {} + const frontierContents: Record = Object.create(null) for (const [k, v] of Object.entries(resFrontierBlockInfo.contents)) { frontierContents[k] = v } diff --git a/src/lib/database.ts b/src/lib/database.ts index 09c39d3..571da1f 100644 --- a/src/lib/database.ts +++ b/src/lib/database.ts @@ -107,7 +107,7 @@ export class Database { return new Promise((resolve, reject) => { const requests = ids.map(id => db.get(id)) transaction.oncomplete = (event) => { - const results: Record = {} + const results: Record = Object.create(null) for (const request of requests) { if (request?.result?.id != null) { results[request.result.id] = request.error ?? request.result @@ -139,7 +139,7 @@ export class Database { } else if (request.result == null) { reject('getAll request failed') } else { - const results: Record = {} + const results: Record = Object.create(null) for (const result of request.result) { results[result.id] = request.error ?? result } diff --git a/src/lib/rpc/accounts_balances.ts b/src/lib/rpc/accounts_balances.ts index 3ab1fc8..ebc90e0 100644 --- a/src/lib/rpc/accounts_balances.ts +++ b/src/lib/rpc/accounts_balances.ts @@ -16,7 +16,7 @@ type AccountsBalancesResponse = { export function accounts_balances (body: unknown): AccountsBalancesResponse { if (body != null && typeof body === 'object') { - const response: AccountsBalancesResponse = {} + const response: AccountsBalancesResponse = Object.create(null) if ('errors' in body && body.errors != null && typeof body.errors === 'object') { for (const [address, error] of Object.entries(body.errors) as [string, unknown][]) { @@ -28,7 +28,7 @@ export function accounts_balances (body: unknown): AccountsBalancesResponse { throw new RpcError(error) } } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[address] = err?.message } } @@ -43,10 +43,10 @@ export function accounts_balances (body: unknown): AccountsBalancesResponse { if (data == null || typeof data !== 'object') { throw new RpcError('Invalid account balance data') } - response.balances ??= {} + response.balances ??= Object.create(null) response.balances[address] = account_balance(data) } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[address] ??= err?.message } } diff --git a/src/lib/rpc/accounts_frontiers.ts b/src/lib/rpc/accounts_frontiers.ts index 56c6955..5b84d45 100644 --- a/src/lib/rpc/accounts_frontiers.ts +++ b/src/lib/rpc/accounts_frontiers.ts @@ -15,7 +15,7 @@ export type AccountsFrontiersResponse = { } export function accounts_frontiers (body: unknown): AccountsFrontiersResponse { - const response: AccountsFrontiersResponse = {} + const response: AccountsFrontiersResponse = Object.create(null) if (body == null || typeof body !== 'object') { return response } @@ -30,11 +30,11 @@ export function accounts_frontiers (body: unknown): AccountsFrontiersResponse { throw new RpcError('Invalid account address') } if (hex.is(frontier, 64)) { - response.frontiers ??= {} - response.frontiers[address] = frontier + response.frontiers ??= Object.create(null) + response.frontiers[address] = frontier } } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[address] = err?.message } } @@ -52,7 +52,7 @@ export function accounts_frontiers (body: unknown): AccountsFrontiersResponse { throw new Error(error) } } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[address] = err?.message } } diff --git a/src/lib/rpc/blocks_info.ts b/src/lib/rpc/blocks_info.ts index 12de6e5..2260bff 100644 --- a/src/lib/rpc/blocks_info.ts +++ b/src/lib/rpc/blocks_info.ts @@ -17,7 +17,7 @@ export type BlocksInfoResponse = { export function blocks_info (body: unknown): BlocksInfoResponse { if (body != null && typeof body === 'object') { - const response: BlocksInfoResponse = {} + const response: BlocksInfoResponse = Object.create(null) if ('errors' in body && body.errors != null && typeof body.errors === 'object') { for (const [hash, error] of Object.entries(body.errors) as [string, unknown][]) { @@ -28,7 +28,7 @@ export function blocks_info (body: unknown): BlocksInfoResponse { throw new Error('Invalid blocks_info error') } } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[hash] = err?.message } } @@ -38,13 +38,13 @@ export function blocks_info (body: unknown): BlocksInfoResponse { for (const [hash, data] of Object.entries(body.blocks) as [string, unknown][]) { try { if (hex.is(hash)) { - response.blocks ??= {} + response.blocks ??= Object.create(null) response.blocks[hash] = block_info(data) } else { throw new Error('Invalid blocks_info hash') } } catch (err: any) { - response.errors ??= {} + response.errors ??= Object.create(null) response.errors[hash] ??= err?.message } } diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts index c575260..cce4181 100644 --- a/src/lib/vault/vault-worker.ts +++ b/src/lib/vault/vault-worker.ts @@ -82,7 +82,7 @@ const listener = (event: MessageEvent): void => { } }) .then((result: Record | void) => { - result ??= {} + result ??= Object.create(null) const transfer: ArrayBuffer[] = [] if (result) { for (const r of Object.values(result)) { @@ -197,7 +197,7 @@ function derive (index?: number | Uint32Array): Promise { - const data: Record = {} + const data: Record = Object.create(null) for (const result of results) { data[result.index] = result.publicKey } diff --git a/src/lib/wallet/create.ts b/src/lib/wallet/create.ts index cf6fb52..358f7d8 100644 --- a/src/lib/wallet/create.ts +++ b/src/lib/wallet/create.ts @@ -10,7 +10,7 @@ import { Wallet } from '../wallet' export async function _create (wallet: Wallet, vault: Vault, password?: string, mnemonicSalt?: string): Promise<{ mnemonic?: ArrayBuffer, seed?: ArrayBuffer }> export async function _create (wallet: Wallet, vault: Vault, password: unknown, mnemonicSalt?: unknown): Promise<{ mnemonic?: ArrayBuffer, seed?: ArrayBuffer }> { try { - const result: { mnemonic?: ArrayBuffer, seed?: ArrayBuffer } = {} + const result: { mnemonic?: ArrayBuffer, seed?: ArrayBuffer } = Object.create(null) const record = { id: wallet.id, type: wallet.type, diff --git a/test/GLOBALS.mjs b/test/GLOBALS.mjs index 17acc98..16b6f0f 100644 --- a/test/GLOBALS.mjs +++ b/test/GLOBALS.mjs @@ -13,14 +13,14 @@ const auth = env.LIBNEMO_RPC_AUTHORIZATION export const rpc = new Rpc(url, auth) if (globalThis.sessionStorage == null) { - let _sessionStorage = {} + let _sessionStorage = Object.create(null) Object.defineProperty(globalThis, 'sessionStorage', { value: { length: Object.entries(_sessionStorage).length, setItem: (key, value) => _sessionStorage[key] = value, getItem: (key) => _sessionStorage[key], removeItem: (key) => delete _sessionStorage[key], - clear: () => _sessionStorage = {} + clear: () => _sessionStorage = Object.create(null) }, configurable: true, enumerable: true