Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add safer version of hasOwnProperty() #14

Closed
davepacheco opened this issue Jan 20, 2016 · 3 comments
Closed

add safer version of hasOwnProperty() #14

davepacheco opened this issue Jan 20, 2016 · 3 comments

Comments

@davepacheco
Copy link
Contributor

It's common to use obj.hasOwnProperty(key) to determine if the object obj has a property called key. This fails badly if obj can have a key called hasOwnProperty that's unrelated to the method. This might be possible of obj is an object whose keys represent HTTP headers sent by an untrusted user. Such a user can break a program using obj.hasOwnProperty(key) by passing a header called hasOwnProperty. To avoid this, programs can use Object.hasOwnProperty.call(obj, key). This is a little obscure (and verbose), so it would be nice to have a jsprim method to implement this.
@jclulow
Copy link
Contributor

jclulow commented Jan 20, 2016

Can it be a relatively short method, e.g. jsprim.hasProp(obj, key) ?

@davepacheco
Copy link
Contributor Author

Sure. I'm not necessarily planning to do this right away. I filed an issue so I wouldn't forget about it.

davepacheco pushed a commit that referenced this issue Jun 23, 2016
#14 add safer version of hasOwnProperty()
b5acfc2 
#15 forEachKey() should ignore inherited properties
Reviewed by: Joshua M. Clulow <[email protected]>
Reviewed by: Alex Wilson <[email protected]>
@davepacheco
Copy link
Contributor Author

This was done a while ago.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jclulow @davepacheco