fix: clone empty arrays / objects if set as $default, throw if not …

…an empty object

src/defaults.js

@@ -7,6 +7,7 @@ const getOwnProperty = require('./helpers/getOwnProperty');
 const join = require('./unmarshal/util').join;
 const realPathToSchemaPath = require('./unmarshal/util').realPathToSchemaPath;
 const shouldSkipPath = require('./util').shouldSkipPath;
+const util = require('util');
 
 function applyDefaults(obj, schema, projection) {
   const keys = Object.keys(schema._obj);
@@ -31,7 +32,7 @@ function defaults(root, v, schema, path, projection) {
   }
 
   if ('$default' in schemaPath) {
-    return handleDefault(schemaPath.$default, root);
+    return handleDefault(schemaPath.$default, root, path);
   }
 
   if (schemaPath.$type === Object && getOwnProperty(schemaPath, '$schema') != null) {
@@ -65,9 +66,22 @@ function defaults(root, v, schema, path, projection) {
   }
 }
 
-function handleDefault(obj, ctx) {
+function handleDefault(obj, ctx, path) {
   if (typeof obj === 'function') {
     return obj(ctx);
   }
+  // If default is an object type, be very careful -
+  // returning an object default would be by reference,
+  // which means user data could modify the default.
+  if (typeof obj === 'object' && obj != null) {
+    if (Array.isArray(obj) && obj.length === 0) {
+      return [];
+    } else if (!Array.isArray(obj) && Object.keys(obj).length === 0) {
+      return {};
+    }
+    throw new Error('Default at path `' + path + '` is a non-empty ' +
+      'object `' + util.inspect(obj) + '`. Please make `$default` ' +
+      'a function that returns an object instead');
+  }
   return obj;
 }

src/path.js

@@ -1,7 +1,20 @@
 'use strict';
 
+const util = require('util');
+
 class Path {
   constructor(obj) {
+    if (obj != null && obj.$default != null && typeof obj.$default === 'object') {
+      const $default = obj.$default;
+      const numKeys = Array.isArray($default) ?
+        $default.length :
+        Object.keys(obj).length;
+      if (numKeys > 0) {
+        throw new Error('Default is a non-empty object ' +
+          util.inspect($default) + '`. Please make `$default` a function ' +
+          'that returns an object instead');
+      }
+    }
     Object.assign(this, obj);
   }
 }

test/defaults.test.js

@@ -58,4 +58,49 @@ describe('defaults', function() {
     assert.equal(v.multiple.a, 'test');
     assert.equal(v.multiple.b, 'foo');
   });
+
+  it('clones empty default array and object', function() {
+    const T = new Archetype({
+      myArr: {
+        $type: ['string'],
+        $default: []
+      },
+      myObj: {
+        $type: Object,
+        $default: {}
+      }
+    }).compile('T');
+
+    const obj1 = new T({});
+
+    obj1.myArr.push('test');
+    obj1.myObj.hello = 'world';
+
+    assert.equal(obj1.myArr[0], 'test');
+    assert.equal(obj1.myObj.hello, 'world');
+
+    const obj2 = new T({});
+    assert.deepEqual(obj2.myArr, []);
+    assert.deepEqual(obj2.myObj, {});
+  });
+
+  it('throws if default is non-empty object', function() {
+    assert.throws(() => {
+      new Archetype({
+        myArr: {
+          $type: ['string'],
+          $default: ['test']
+        }
+      }).compile('T');
+    }, /Default is a non-empty object/);
+
+    assert.throws(() => {
+      new Archetype({
+        myArr: {
+          $type: {},
+          $default: { test: 42 }
+        }
+      }).compile('T');
+    }, /Default is a non-empty object/);
+  });
 });