Avoid prototype builtin hasOwnProperty (#577)

multipart/formfile.ts

@@ -1,4 +1,5 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
+import { hasOwnProperty } from "../util/has_own_property.ts";
 
 /** FormFile object */
 export interface FormFile {
@@ -19,9 +20,5 @@ export interface FormFile {
 /** Type guard for FormFile */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function isFormFile(x: any): x is FormFile {
- return (
- typeof x === "object" &&
- x.hasOwnProperty("filename") &&
- x.hasOwnProperty("type")
- );
+ return hasOwnProperty(x, "filename") && hasOwnProperty(x, "type");
 }

multipart/formfile_test.ts

@@ -18,3 +18,15 @@ test(function multipartIsFormFile(): void {
  false
  );
 });
+
+test(function isFormFileShouldNotThrow(): void {
+ assertEquals(
+ isFormFile({
+ filename: "foo",
+ type: "application/json",
+ hasOwnProperty: "bar"
+ }),
+ true
+ );
+ assertEquals(isFormFile(Object.create(null)), false);
+});

util/has_own_property.ts

@@ -0,0 +1,30 @@
+// Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
+
+/**
+ * Determines whether an object has a property with the specified name.
+ * Avoid calling prototype builtin `hasOwnProperty` for two reasons:
+ *
+ * 1. `hasOwnProperty` is defined on the object as something else:
+ *
+ * const options = {
+ * ending: 'utf8',
+ * hasOwnProperty: 'foo'
+ * };
+ * options.hasOwnProperty('ending') // throws a TypeError
+ *
+ * 2. The object doesn't inherit from `Object.prototype`:
+ *
+ * const options = Object.create(null);
+ * options.ending = 'utf8';
+ * options.hasOwnProperty('ending'); // throws a TypeError
+ *
+ * @param obj A Object.
+ * @param v A property name.
+ * @see https://eslint.org/docs/rules/no-prototype-builtins
+ */
+export function hasOwnProperty<T>(obj: T, v: PropertyKey): boolean {
+ if (obj == null) {
+ return false;
+ }
+ return Object.prototype.hasOwnProperty.call(obj, v);
+}

ws/mod.ts

@@ -1,6 +1,7 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
 
 import { decode, encode } from "../strings/mod.ts";
+import { hasOwnProperty } from "../util/has_own_property.ts";
 
 type Conn = Deno.Conn;
 type Writer = Deno.Writer;
@@ -34,7 +35,7 @@ export interface WebSocketCloseEvent {
 export function isWebSocketCloseEvent(
  a: WebSocketEvent
 ): a is WebSocketCloseEvent {
- return typeof a === "object" && a.hasOwnProperty("code");
+ return hasOwnProperty(a, "code");
 }
 
 export type WebSocketPingEvent = ["ping", Uint8Array];