Add prototype-pollution guards and array key helpers by nev21 · Pull Request #565 · nevware21/ts-utils

nev21 · 2026-05-16T22:45:31Z

Add new public helpers for safe own-key iteration and unsafe target/key detection, plus new array key utilities for dense and sparse array-like values.

add forEachOwnKeySafe(), isUnsafePropKey(), and isUnsafeTarget()
update deep copy logic to use safe own-key iteration
add arrKeys() iterator and arrIndexKeys() own-index enumeration
export the new public APIs from the main index
add tests covering sparse arrays, array-like values, and unsafe keys
document the new security helpers in README and docs

codecov · 2026-05-16T22:48:24Z

Codecov Report

❌ Patch coverage is 98.93048% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 99.43%. Comparing base (4d28559) to head (203fc5b).

Files with missing lines	Patch %	Lines
lib/src/helpers/get_set_value.ts	94.59%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #565      +/-   ##
==========================================
- Coverage   99.46%   99.43%   -0.03%     
==========================================
  Files         145      150       +5     
  Lines        4271     4452     +181     
  Branches      938      955      +17     
==========================================
+ Hits         4248     4427     +179     
- Misses         23       25       +2

Files with missing lines	Coverage Δ
lib/src/array/arrIndexKeys.ts	`100.00% <100.00%> (ø)`
lib/src/array/arrKeys.ts	`100.00% <100.00%> (ø)`
lib/src/array/groupBy.ts	`100.00% <100.00%> (ø)`
lib/src/internal/constants.ts	`100.00% <100.00%> (ø)`
lib/src/internal/treeshake_helpers.ts	`100.00% <100.00%> (ø)`
lib/src/object/copy.ts	`100.00% <100.00%> (ø)`
lib/src/object/forEachOwnKeySafe.ts	`100.00% <100.00%> (ø)`
lib/src/object/for_each_key.ts	`100.00% <100.00%> (ø)`
lib/src/object/isUnsafePropKey.ts	`100.00% <100.00%> (ø)`
lib/src/object/isUnsafeTarget.ts	`100.00% <100.00%> (ø)`
... and 2 more

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Adds prototype-pollution defenses and new array key helpers. Introduces public forEachOwnKeySafe, isUnsafePropKey, and isUnsafeTarget helpers; routes deep-copy and path-based setters through them; adds arrKeys/polyArrKeys and arrIndexKeys for dense/sparse array-like iteration; and extends lib/src/internal/constants.ts with many new built-in class/prototype constants used by isUnsafeTarget.

Changes:

New safe iteration / unsafe key & target detection helpers, applied to objDeepCopy, setValueByKey, setValueByIter, arrGroupBy, and polyObjFromEntries.
New arrKeys/arrIndexKeys array utilities (with polyfill) and tests covering sparse and array-like values.
Constants file gains class/prototype references for Number, Symbol, Function, Date, RegExp, Boolean, Error, Map, Set (plus an unused MathProto); README, docs, package keywords, and size limits updated.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Documents new security helpers and adds `arrKeys`/`arrIndexKeys` and new object helpers to the indexes.
package.json, lib/package.json	Adds keywords for the new helpers and a few unrelated terms.
.size-limit.json	Raises bundle-size limits to accommodate the new code.
docs/README.md, docs/security-helpers.md	Adds the Security Helpers guide.
lib/src/index.ts	Exports `arrKeys`, `arrIndexKeys`, `forEachOwnKeySafe`, `isUnsafePropKey`, `isUnsafeTarget`.
lib/src/internal/constants.ts	Adds many new class/prototype constants (including unused `MathProto`); direct `Map`/`Set`/`Symbol` global access at module load.
lib/src/internal/treeshake_helpers.ts	`_pureRef` now null-guards `value` before property access.
lib/src/object/forEachOwnKeySafe.ts	New safe own-key iterator skipping `__proto__`/`constructor`/`prototype`.
lib/src/object/isUnsafePropKey.ts	Identifies the three poisoning keys.
lib/src/object/isUnsafeTarget.ts	Identifies built-in prototype objects via cached list.
lib/src/object/for_each_key.ts	Doc note and minor TS typing tweak.
lib/src/object/copy.ts	`_copyProps` now uses `forEachOwnKeySafe` and skips when `isUnsafeTarget(source)`.
lib/src/array/arrKeys.ts, arrIndexKeys.ts	New helpers + polyfill.
lib/src/array/groupBy.ts	Uses `objDefine` so unsafe group keys become own enumerable props instead of mutating prototypes.
lib/src/helpers/get_set_value.ts	`setValueByKey`/`setValueByIter` reject paths containing unsafe keys.
lib/src/polyfills/object/objFromEntries.ts	Defines `__proto__` as a real own property instead of triggering the setter.
lib/test/src/common/...test.ts	New/updated tests for the helpers and prototype-pollution scenarios.

nevware21-bot

Approved by nevware21-bot

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated no new comments.

Add new public helpers for safe own-key iteration and unsafe target/key detection, plus new array key utilities for dense and sparse array-like values. - add forEachOwnKeySafe(), isUnsafePropKey(), and isUnsafeTarget() - update deep copy logic to use safe own-key iteration - add arrKeys() iterator and arrIndexKeys() own-index enumeration - export the new public APIs from the main index - add tests covering sparse arrays, array-like values, and unsafe keys - document the new security helpers in README and docs

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

nevware21-bot

Approved by nevware21-bot

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

## Release v0.14.0 This PR increases the version to `0.14.0` and updates the changelog with all significant changes since v0.13.0. ### Summary of Changes #### Features - New array helpers and array-like detection (#525) - `strReplace` and `strReplaceAll` string helpers (#527) - `strCapitalizeWords` helper (#528) - `strTruncate`, `strCount`, `strAt`, `strMatchAll` helpers (#529, #530) - `arrFlatMap` with ES5 polyfill (#533) - Typing utilities and expanded TSDoc examples (#535) - `isAsyncIterable` and `isIntegerInRange` helpers (#536) - `strStartsWithAny`, `strEndsWithAny`, `strWrap`, `strUnwrap`, `strNormalizeNewlines` (#543) - New object utility helpers and prototype pollution hardening (#564, #565) #### Bug Fixes - Fix ES2015 built-in type errors in consumers by adding lib reference directive to published declarations (#558) - Fix `thisArg` binding in `polyArrFindIndex` / `polyArrFindLastIndex` polyfills (#562) - Fix falsy `thisArg` (0, `''`, `false`) being overridden in `arrForEach`, `iterForOf`, `objForEachKey` (#566) #### Repository Improvements - Drop Node.js 16 from CI matrix and add Node.js 24 (#549) - Upgrade Grunt devDependency to v1.6.2 (#552) - Add funding metadata to published package manifests (#554) ### Files Updated - `CHANGELOG.md` — Added v0.14.0 entry - `package.json` — Version bumped to 0.14.0 - `lib/package.json` — Version bumped to 0.14.0 - `README.md` — Updated recommended version specification

nev21 added this to the 0.14.0 milestone May 16, 2026

nev21 requested a review from a team as a code owner May 16, 2026 22:45

Copilot AI review requested due to automatic review settings May 16, 2026 22:45

nev21 requested a review from a team as a code owner May 16, 2026 22:45

Copilot started reviewing on behalf of nev21 May 16, 2026 22:46 View session

nev21 mentioned this pull request May 16, 2026

fix: prevent prototype pollution in objDeepCopy/objCopyProps #563

Closed

Copilot AI reviewed May 16, 2026

View reviewed changes

Comment thread lib/src/internal/constants.ts Outdated

Comment thread lib/src/internal/constants.ts Outdated

Comment thread lib/src/helpers/get_set_value.ts

Comment thread lib/src/object/isUnsafeTarget.ts

nev21 force-pushed the nev21/CVE-2026-46681 branch from 49b734f to 07d629d Compare May 16, 2026 22:50

nevware21-bot previously approved these changes May 16, 2026

View reviewed changes

nev21 dismissed nevware21-bot’s stale review via 1eec7c7 May 16, 2026 23:35

nev21 force-pushed the nev21/CVE-2026-46681 branch from 07d629d to 1eec7c7 Compare May 16, 2026 23:35

nev21 requested a review from Copilot May 16, 2026 23:35

Copilot started reviewing on behalf of nev21 May 16, 2026 23:35 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

nev21 force-pushed the nev21/CVE-2026-46681 branch from 1eec7c7 to 203fc5b Compare May 17, 2026 01:18

nev21 requested a review from Copilot May 17, 2026 01:18

Copilot started reviewing on behalf of nev21 May 17, 2026 01:18 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

nevware21-bot approved these changes May 17, 2026

View reviewed changes

nev21 requested a review from Copilot May 17, 2026 02:17

Copilot started reviewing on behalf of nev21 May 17, 2026 02:18 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

nev21 merged commit 26b4766 into main May 17, 2026
16 of 18 checks passed

nev21 deleted the nev21/CVE-2026-46681 branch May 17, 2026 02:28

nev21 mentioned this pull request May 19, 2026

[Release] Increase version to 0.14.0 #567

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add prototype-pollution guards and array key helpers#565

Add prototype-pollution guards and array key helpers#565
nev21 merged 1 commit into
mainfrom
nev21/CVE-2026-46681

nev21 commented May 16, 2026

Uh oh!

codecov Bot commented May 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nevware21-bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

nevware21-bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

nev21 commented May 16, 2026

Uh oh!

codecov Bot commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nevware21-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

nevware21-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented May 16, 2026 •

edited

Loading