Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[1.x] Fix reactivity conflict caused by Object.prototype.hasOwnProperty #35

Closed
wants to merge 1 commit into from

Conversation

Tofandel
Copy link
Contributor

Fixes #34

Copy link
Member

@saibotk saibotk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me thank you very much!

Can you fix the eslint warnings ans add some ignores for the hasOwnProperty usage with a comment that this is to allow reactivity?

Oh and quickly add a line to the Changelog and we are ready to merge

@Tofandel
Copy link
Contributor Author

Done

Copy link
Member

@djfhe djfhe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, thanks for looking into this!
I suggest an alternative solution to avoid any security risks while still fixing it.

Let me here your thoughts on this!

Comment on lines +238 to +239
// eslint-disable-next-line no-prototype-builtins
!current?.hasOwnProperty(pathPart) // We use the builtin to avoid reactivity issues with Proxy
Copy link
Member

@djfhe djfhe Aug 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// eslint-disable-next-line no-prototype-builtins
!current?.hasOwnProperty(pathPart) // We use the builtin to avoid reactivity issues with Proxy
current === null ||
current[pathPart] === undefined || // Trigger dependency tracking for libraries (e.g. vue)
!hasOwnProperty.call(current, pathPart)

I would suggest this. We still use the global hasOwnProperty function but signal vue, that we access the property so its depedency tracking works.

Comment on lines +283 to +284
// eslint-disable-next-line no-prototype-builtins
!current?.hasOwnProperty(pathPart)
Copy link
Member

@djfhe djfhe Aug 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// eslint-disable-next-line no-prototype-builtins
!current?.hasOwnProperty(pathPart)
current === null ||
current[pathPart] === undefined || // Trigger dependency tracking for libraries (e.g. vue)
!hasOwnProperty.call(current, pathPart)

The same here. Adding this undefined check should not change behavior, since the check in line 292 would have catched the undefined parentObject otherwise.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems like a good alternative, I see that you already released it, so I will close this

@saibotk saibotk changed the base branch from main to 1.x August 18, 2024 05:14
@saibotk saibotk changed the title Fix reactivity conflict caused by Object.prototype.hasOwnProperty [1.x] Fix reactivity conflict caused by Object.prototype.hasOwnProperty Aug 18, 2024
@Tofandel Tofandel closed this Aug 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

HasOwnProperty check causes reactivity issues
3 participants