Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for __proto__ as mapping key & anchor identifier #192

Merged
merged 3 commits into from
Sep 6, 2020
Merged

Conversation

eemeli
Copy link
Owner

@eemeli eemeli commented Sep 2, 2020

JavaScript still supports the deprecated Object.prototype.__proto__ accessor for an object's prototype. This means that using __proto__ as a mapping key or an anchor name does unexpected things. For example:

const obj = YAML.parse('{ __proto__: [42] }') // Array {}
obj[0] // 42
obj.hasOwnProperty('__proto__') // false
JSON.stringify(obj) // '{}'

In other words, the value set for __proto__ would be assigned as the prototype of the generated object, unless you enabled the mapAsMap option. Using it as an anchor just wouldn't work.

Just to be clear, this isn't about prototype pollution: no existing prototypes get modified at any point, they just get created unexpectedly.

This PR allows for __proto__ as a mapping key or an anchor. The fixes should be robust enough that any other potential weirdnesses arising from inheriting from Object are averted as well.

@eemeli eemeli added the bug Something isn't working label Sep 2, 2020
@eemeli eemeli merged commit 4ab632e into master Sep 6, 2020
@eemeli eemeli deleted the proto branch September 6, 2020 17:27
eemeli added a commit that referenced this pull request Mar 13, 2021
* Allow for __proto__ as an anchor name
* Support __proto__ as key in collectionFromPath()
* Support __proto__ as mapping key
This was referenced Mar 14, 2021
mergify bot pushed a commit to projen/projen that referenced this pull request Mar 15, 2021
Bumps [yaml](https://github.com/eemeli/yaml) from 1.10.0 to 1.10.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/eemeli/yaml/releases">yaml's releases</a>.</em></p>
<blockquote>
<h2>v1.10.2</h2>
<ul>
<li>Allow for unindented comment after node props (prettier/prettier#10510)</li>
</ul>
<h2>v1.10.1</h2>
<p>This release backports the following non-breaking fixes made during the work on <code>yaml@2</code> on top of <code>yaml@1.10.0</code>:</p>
<ul>
<li>Support for<code> __proto__</code> as mapping key &amp; anchor identifier (<a href="https://github.com/eemeli/yaml/issues/192">#192</a>)</li>
<li>Fix broken TS type for BigInt toggle</li>
<li>Dump long keys properly (<a href="https://github.com/eemeli/yaml/issues/195">#195</a>)</li>
<li>When folding highly indented lines, require at least <code>minContentWidth</code> chars on the first line (<a href="https://github.com/eemeli/yaml/issues/196">#196</a>)</li>
<li>Fix <code>YAML.stringify()</code> for certain null values (<a href="https://github.com/eemeli/yaml/issues/197">#197</a>)</li>
<li>Do not break escaped chars with escaped newlines (<a href="https://github.com/eemeli/yaml/issues/237">#237</a>, <a href="https://github.com/awslabs/cdk8s/issues/8">awslabs/cdk8s8</a>)</li>
<li>Set <code>type: &quot;module&quot;</code> within browser/dist/ (<a href="https://github.com/eemeli/yaml/issues/208">#208</a>)</li>
<li>Use CommonJS for the browser endpoints <code>yaml/types</code> &amp; <code>yaml/util</code> (<a href="https://github.com/eemeli/yaml/issues/208">#208</a>)</li>
<li>Always stringify non-Node object keys using explicit notation (<a href="https://github.com/eemeli/yaml/issues/218">#218</a>)</li>
<li>Specify node type of <code>Document.Parsed.contents</code> (<a href="https://github.com/eemeli/yaml/issues/221">#221</a>)</li>
<li>Add missing type for CST <code>Node.rangeAsLinePos</code> (<a href="https://github.com/eemeli/yaml/issues/222">#222</a>)</li>
<li>Prefer literal over folded block scalar when <code>lineWidth=0</code> is set (<a href="https://github.com/eemeli/yaml/issues/232">#232</a>)</li>
<li>Allow for empty lines after node props (<a href="https://github.com/eemeli/yaml/issues/242">#242</a>)</li>
<li>Update dev dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/eemeli/yaml/commit/4cdcde632ece71155f3108ec0120c1a0329a6914"><code>4cdcde6</code></a> 1.10.2</li>
<li><a href="https://github.com/eemeli/yaml/commit/7c0e08316d82f167ac0a054428627f6e1f20ac6e"><code>7c0e083</code></a> Allow for unindented comment after node props (<a href="https://github.com/eemeli/yaml/issues/242">#242</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/8ef015788b219a4b249736f4bb8968dafe68dcc4"><code>8ef0157</code></a> 1.10.1</li>
<li><a href="https://github.com/eemeli/yaml/commit/6296dae2e5f61a4aa4605b4a374bd94ec5713c3a"><code>6296dae</code></a> Update links in docs</li>
<li><a href="https://github.com/eemeli/yaml/commit/b1d2b287e80caeb262c4dc81459f52b982a5e741"><code>b1d2b28</code></a> Allow for empty lines after node props (Fixes <a href="https://github.com/eemeli/yaml/issues/242">#242</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/3e5a64098791ea7a7c01a5465a0794049b511367"><code>3e5a640</code></a> Satisfy Prettier</li>
<li><a href="https://github.com/eemeli/yaml/commit/bd031cb67f4411826bd61cc2b3bbe21b1b398755"><code>bd031cb</code></a> Update dev dependencies + switch to lockfileVersion 2</li>
<li><a href="https://github.com/eemeli/yaml/commit/9c6e7d0ed367b2af439cfc52936e65b2fc3e5ecc"><code>9c6e7d0</code></a> Use CommonJS for browser endpoints yaml/types &amp; yaml/util (<a href="https://github.com/eemeli/yaml/issues/208">#208</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/7ddb18b4e18d4d4625b94af8f64738a4725cbbb5"><code>7ddb18b</code></a> Prefer literal over folded block scalar when lineWidth=0 is set (<a href="https://github.com/eemeli/yaml/issues/232">#232</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/fd817be1774145aec9354a30c4b48cc08fe98e41"><code>fd817be</code></a> Update dev dependencies</li>
<li>Additional commits viewable in <a href="https://github.com/eemeli/yaml/compare/v1.10.0...v1.10.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=yaml&package-manager=npm_and_yarn&previous-version=1.10.0&new-version=1.10.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually


</details>
This was referenced Mar 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant