-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[1.x] Fix reactivity conflict caused by Object.prototype.hasOwnProperty #35
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me thank you very much!
Can you fix the eslint warnings ans add some ignores for the hasOwnProperty usage with a comment that this is to allow reactivity?
Oh and quickly add a line to the Changelog and we are ready to merge
Done |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi, thanks for looking into this!
I suggest an alternative solution to avoid any security risks while still fixing it.
Let me here your thoughts on this!
// eslint-disable-next-line no-prototype-builtins | ||
!current?.hasOwnProperty(pathPart) // We use the builtin to avoid reactivity issues with Proxy |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// eslint-disable-next-line no-prototype-builtins | |
!current?.hasOwnProperty(pathPart) // We use the builtin to avoid reactivity issues with Proxy | |
current === null || | |
current[pathPart] === undefined || // Trigger dependency tracking for libraries (e.g. vue) | |
!hasOwnProperty.call(current, pathPart) |
I would suggest this. We still use the global hasOwnProperty
function but signal vue, that we access the property so its depedency tracking works.
// eslint-disable-next-line no-prototype-builtins | ||
!current?.hasOwnProperty(pathPart) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// eslint-disable-next-line no-prototype-builtins | |
!current?.hasOwnProperty(pathPart) | |
current === null || | |
current[pathPart] === undefined || // Trigger dependency tracking for libraries (e.g. vue) | |
!hasOwnProperty.call(current, pathPart) |
The same here. Adding this undefined check should not change behavior, since the check in line 292 would have catched the undefined parentObject
otherwise.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This seems like a good alternative, I see that you already released it, so I will close this
Fixes #34