From 9d67b5c6c8d3683d8bcbd649daa6d0d0567f865b Mon Sep 17 00:00:00 2001 From: luin Date: Wed, 18 Aug 2021 23:47:39 +0800 Subject: [PATCH 1/2] fix: improve proto checking for hgetall As mentioned in https://github.com/luin/ioredis/issues/1417 --- lib/command.ts | 2 +- test/functional/hgetall.ts | 30 +++++++++++++++++++++++++++--- 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/lib/command.ts b/lib/command.ts index ab0d5661..35e4a5e6 100644 --- a/lib/command.ts +++ b/lib/command.ts @@ -429,7 +429,7 @@ Command.setReplyTransformer("hgetall", function (result) { for (let i = 0; i < result.length; i += 2) { const key = result[i]; const value = result[i + 1]; - if (obj[key]) { + if (key in obj) { // can only be truthy if the property is special somehow, like '__proto__' or 'constructor' // https://github.com/luin/ioredis/issues/1267 Object.defineProperty(obj, key, { diff --git a/test/functional/hgetall.ts b/test/functional/hgetall.ts index f4a38d8d..d6bad4f7 100644 --- a/test/functional/hgetall.ts +++ b/test/functional/hgetall.ts @@ -1,12 +1,36 @@ import Redis from "../../lib/redis"; import { expect } from "chai"; +const CUSTOM_PROPERTY = "_myCustomProperty"; + describe("hgetall", function () { - it("should handle __proto__", async function () { + beforeEach(function () { + Object.defineProperty(Object.prototype, CUSTOM_PROPERTY, { + value: false, + configurable: true, + enumerable: false, + writable: false, + }); + }); + + afterEach(function () { + delete (Object.prototype as any)[CUSTOM_PROPERTY]; + }); + + it("should handle special field names", async function () { const redis = new Redis(); - await redis.hset("test_key", "__proto__", "hello"); + await redis.hmset( + "test_key", + "__proto__", + "hello", + CUSTOM_PROPERTY, + "world" + ); const ret = await redis.hgetall("test_key"); expect(ret.__proto__).to.eql("hello"); - expect(Object.keys(ret)).to.eql(["__proto__"]); + expect(ret[CUSTOM_PROPERTY]).to.eql("world"); + expect(Object.keys(ret).sort()).to.eql( + ["__proto__", CUSTOM_PROPERTY].sort() + ); }); }); From 9b5810e091580f8e697954348765fd3d80a5b62b Mon Sep 17 00:00:00 2001 From: luin Date: Thu, 19 Aug 2021 00:39:46 +0800 Subject: [PATCH 2/2] Address feedbacks --- test/functional/hgetall.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/test/functional/hgetall.ts b/test/functional/hgetall.ts index d6bad4f7..344f702c 100644 --- a/test/functional/hgetall.ts +++ b/test/functional/hgetall.ts @@ -32,5 +32,6 @@ describe("hgetall", function () { expect(Object.keys(ret).sort()).to.eql( ["__proto__", CUSTOM_PROPERTY].sort() ); + expect(Object.getPrototypeOf(ret)).to.eql(Object.prototype); }); });