fix(shared): prevent prototype injection in set util

[dinwwwh]

What

Hardens the set util in @orpc/shared against prototype injection.

Previously, a path like ['__proto__', 'polluted'] would read the inherited __proto__ getter, walk into Object.prototype, and write onto it — polluting every object. ['constructor', 'prototype', 'x'] reached the same place through the Object constructor.

How

Mirrors the Object.hasOwn guard that get already uses:

• Traversal only descends into own properties; inherited intermediates (__proto__, constructor, …) are treated as absent, so a fresh plain object is created instead of walking the prototype chain.
• Writes go through Object.defineProperty (writable/enumerable/configurable), which creates an own data property even for keys like __proto__ instead of triggering the inherited setter that would swap the object's prototype.

Includes tests for the __proto__ and constructor.prototype pollution vectors.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
orpc	Ready	Preview, Comment	Jul 29, 2026 2:50am

[pkg-pr-new]

More templates

• @orpc/bun-playground
• @orpc/cloudflare-playground
• @orpc/nest-playground
• @orpc/next-playground

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1744

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1744

@orpc/bun

npm i https://pkg.pr.new/@orpc/bun@1744

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1744

@orpc/cloudflare

npm i https://pkg.pr.new/@orpc/cloudflare@1744

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1744

@orpc/experimental-effect

npm i https://pkg.pr.new/@orpc/experimental-effect@1744

@orpc/evlog

npm i https://pkg.pr.new/@orpc/evlog@1744

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1744

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1744

@orpc/next

npm i https://pkg.pr.new/@orpc/next@1744

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1744

@orpc/opentelemetry

npm i https://pkg.pr.new/@orpc/opentelemetry@1744

@orpc/pinia-colada

npm i https://pkg.pr.new/@orpc/pinia-colada@1744

@orpc/pino

npm i https://pkg.pr.new/@orpc/pino@1744

@orpc/publisher

npm i https://pkg.pr.new/@orpc/publisher@1744

@orpc/ratelimit

npm i https://pkg.pr.new/@orpc/ratelimit@1744

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1744

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1744

@orpc/swr

npm i https://pkg.pr.new/@orpc/swr@1744

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1744

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1744

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1744

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1744

commit: 4323d0c

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing dinwwwh:claude/set-utils-prototype-injection-c11d6a (4323d0c) with main (cfe8951)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pullfrog]

✅ No new issues found.

Reviewed changes — hardens set() against prototype injection by mirroring the Object.hasOwn traversal guard already used in get(), and switching writes to Object.defineProperty so keys like __proto__ are created as own data properties rather than triggering the inherited setter.

• Add Object.hasOwn traversal guard — intermediate paths like __proto__ and constructor are treated as absent when not own properties, preventing traversal into Object.prototype.
• Switch writes to Object.defineProperty — creates own writable/enumerable/configurable data properties for every key, including __proto__, instead of triggering the inherited setter that would swap the prototype.
• Add pollution-vector tests — covers ['__proto__', 'polluted'], ['constructor', 'prototype', 'polluted'], and a standalone ['__proto__'] set.

  ^{｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏}