[bug] Uncaught TypeError: Cannot assign to read only property 'toString' of object '#<Object>'

[jotyy]

Describe the bug

When I add naive-ui to the latest version of tauri app, it went wrong with lodash-es.

Reproduction

Here is the source code

Expected behavior

No response

Platform and versions

> tauri-app@0.0.0 tauri
> tauri "info"


Operating System - Windows, version 10.0.22000 X64
Webview2 - 98.0.1108.43
Visual Studio Build Tools:
   - Visual Studio Community 2019

Node.js environment
  Node.js - 16.13.1
  @tauri-apps/cli - 1.0.0-rc.2
  @tauri-apps/api - 1.0.0-rc.0

Global packages
  npm - 8.4.0
  pnpm - Not installed
  yarn - 1.22.17

Rust environment
  rustc - 1.60.0-nightly
  cargo - 1.60.0-nightly

Rust environment
  rustup - 1.24.3
  rustc - 1.60.0-nightly
  cargo - 1.60.0-nightly
  toolchain - nightly-x86_64-pc-windows-msvc 

App directory structure
/.git
/.vscode
/dist
/node_modules
/public
/src
/src-tauri

App
  tauri.rs - 1.0.0-rc.0
  build-type - bundle
  CSP - default-src 'self'
  distDir - ../dist
  devPath - http://localhost:3000/
  framework - Vue.js

Stack trace

Uncaught TypeError: Cannot assign to read only property 'toString' of object '#<Object>'
    at lodash.default.js:410:14
    at _createBaseFor.js:17:11
    at baseForOwn (_baseForOwn.js:13:20)
    at lodash.default.js:408:3
    at lodash.default.js:413:10

Additional context

No response

[pwespi]

The same error is happening in a blank Angular Tauri app created with npx create-tauri-app.

Uncaught TypeError: Cannot assign to read only property 'toString' of object '#<Object>'

It's triggered by this line (this is inside Angular's zone.js):

Object.prototype.toString = function () {
  //...
}

The error is happening on both Windows and macOS with the release candidate of Tauri (haven't tested linux). But it is not happening in Tauri beta and not in the browser (Edge nor Safari).

[pwespi]

Probably related to #3406

[srg-kostyrko]

I have the same issue with mobx library
it did not happen in beta version, started happening with release candidate
tested on windows and linux

[lucasfernog]

By default we're freezing the prototype. You can set tauri.conf.json > security > freezePrototype to false to fix this problem. Note that you should freeze the prototype later if possible. Documentation on this will be updated soon.

[lucasfernog]

We're going to publish a new release changing the default value to false since this breaks on several frameworks.

[e792a8]

By default we're freezing the prototype. You can set tauri.conf.json > security > freezePrototype to false to fix this problem. Note that you should freeze the prototype later if possible. Documentation on this will be updated soon.

How about adding a config item like devFreezePrototype (like devCsp to csp) that only applies on dev? The freezePrototype seems to only cause this bug when running a dev server, but not affecting the bundled release version.