Object.prototype builtins should not be used directly JS-0021
Bug risk
Major
4 months ago
—
3 years old
Do not access Object.prototype method 'hasOwnProperty' from target object
10327 (typedoc.transition = (function (tuples) {
10328 for (const name in tuples) {
10329 if (
10330 tuples.hasOwnProperty(name) &&10331 void 0 !== document.body.style[name]
10332 ) {
10333 return { name, endEvent: tuples[name] }Do not access Object.prototype method 'propertyIsEnumerable' from target object
6336 (i = T[t]) in n && n[i] !== u[i] && !h.contains(r, i) && r.push(i)
6337 }
6338 }
6339 const I = !{ toString: null }.propertyIsEnumerable('toString') 6340 var T = [
6341 'valueOf',
6342 'isPrototypeOf',Do not access Object.prototype method 'hasOwnProperty' from target object
1038 ? a(o)
1039 : a.length > 1
1040 ? ((t = [e, e, '', o]),
1041 b.setFilters.hasOwnProperty(e.toLowerCase()) 1042 ? le(function (e, t) {
1043 for (var n, r = a(e, o), i = r.length; i--;) {
1044 e[(n = P(e, r[i]))] = !(t[n] = r[i])Do not access Object.prototype method 'hasOwnProperty' from target object
226 config.set('address_prefix', options.useTestNet ? 'TST' : 'BLT')
227 }
228
229 if (options.hasOwnProperty('url')) {230 let new_index = 0
231 for (let i = 0; i < this.alternative_api_endpoints.length; i++) {
232 const temp_endpoint = this.alternative_api_endpoints[i]Do not access Object.prototype method 'hasOwnProperty' from target object
222 this._setLogger(options)
223 this._setTransport(options)
224 this.transport.setOptions(options)
225 if (options.hasOwnProperty('useTestNet')) {226 config.set('address_prefix', options.useTestNet ? 'TST' : 'BLT')
227 }
228
Description
It is preferable to call certain Object.prototype methods through Object on object instances instead of using the builtins directly.
Objects can have properties that shadow the builtins on Object.prototype, potentially causing unintended behavior or denial-of-service security vulnerabilities.
For example, it would be unsafe for a webserver to parse JSON input from a client and call hasOwnProperty directly on the resulting object, because a malicious client could send a JSON value like {"hasOwnProperty": 1} and cause the server to crash.
It's better to always call these methods from Object.prototype. For example, obj.hasOwnProperty("bar") should be replaced with Object.prototype.hasOwnProperty.call(obj, "bar").
Bad Practice
let hasBarProperty = obj.hasOwnProperty("property");
let isPrototypeOfBar = obj.isPrototypeOf(property);
let barIsEnumerable = obj.propertyIsEnumerable("property");
Recommended
let hasBarProperty = Object.prototype.hasOwnProperty.call(obj, "property");
let isPrototypeOfBar = Object.prototype.isPrototypeOf.call(obj, property);
let barIsEnumerable = {}.propertyIsEnumerable.call(obj, "property");