Fix elements with names from Object.prototype

Closes #3709.
jsdom · May 26, 2024 · a693107 · a693107
1 parent 8738255
commit a693107
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 2 deletions.
diff --git a/lib/jsdom/living/helpers/create-element.js b/lib/jsdom/living/helpers/create-element.js
@@ -15,9 +15,11 @@ const {
 } = require("./custom-elements");
 
 const INTERFACE_TAG_MAPPING = {
+ __proto__: null,
  // https://html.spec.whatwg.org/multipage/dom.html#elements-in-the-dom%3Aelement-interface
  // https://html.spec.whatwg.org/multipage/indices.html#elements-3
  [HTML_NS]: {
+ __proto__: null,
  HTMLElement: [
  "abbr", "address", "article", "aside", "b", "bdi", "bdo", "cite", "code", "dd", "dfn", "dt", "em", "figcaption",
  "figure", "footer", "header", "hgroup", "i", "kbd", "main", "mark", "nav", "noscript", "rp", "rt", "ruby", "s",
@@ -95,17 +97,18 @@ const INTERFACE_TAG_MAPPING = {
  HTMLVideoElement: ["video"]
  },
  [SVG_NS]: {
+ __proto__: null,
  SVGElement: [],
  SVGGraphicsElement: [],
  SVGSVGElement: ["svg"],
  SVGTitleElement: ["title"]
  }
 };
 
-const TAG_INTERFACE_LOOKUP = {};
+const TAG_INTERFACE_LOOKUP = Object.create(null);
 
 for (const namespace of [HTML_NS, SVG_NS]) {
- TAG_INTERFACE_LOOKUP[namespace] = {};
+ TAG_INTERFACE_LOOKUP[namespace] = Object.create(null);
 
  const interfaceNames = Object.keys(INTERFACE_TAG_MAPPING[namespace]);
  for (const interfaceName of interfaceNames) {

diff --git a/test/web-platform-tests/to-upstream/html/syntax/parsing/Object-prototype-names.html b/test/web-platform-tests/to-upstream/html/syntax/parsing/Object-prototype-names.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Element with tag name "constructor", etc.</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<!-- Regression test for https://github.com/jsdom/jsdom/issues/3706 -->
+
+<body>
+<constructor></constructor>
+<hasOwnProperty></hasOwnProperty>
+<__proto__></__proto__>
+<toString></toString>
+
+<script>
+ "use strict";
+ const propNames = ["constructor", "hasOwnProperty", "__proto__", "toString"];
+
+ test(() => {
+ for (const name of propNames) {
+ const el = document.createElement(name);
+ assert_equals(el.localName, name.toLowerCase());
+ assert_equals(el.constructor, HTMLUnknownElement);
+ }
+ }, "Creating HTML elements with property names from Object.prototype should not be problematic");
+
+ test(() => {
+ for (const name of propNames) {
+ const el = document.createElementNS("https://example.com/", name);
+ assert_equals(el.localName, name);
+ assert_equals(el.constructor, Element);
+ }
+ }, "Creating XML elements with property names from Object.prototype should not be problematic");
+</script>