narrowView's extra check uses 'prop in extra', reaching Object.prototype ahead of the guarded-field copy
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript
- Domain
- backend
Research direction
Read src/core/runtime/activation.js around lines 1146-1156, where answers() and read() check extra before the guarded fields. Add an own-property check for extra and tests showing a guarded field named after an Object.prototype member still returns a frozen copy. Record a decision for what String(view) should do after the change.
Written by the indexing model from the issue text.
Description
Source: #2042 at f77424adc609d7e01d9c90304bfe63b3213b5d04
Location: src/core/runtime/activation.js:1146 and :1150
Severity: minor
Evidence
Verified at f77424ad: answers() tests 'prop in extra' (:1146) and read() tests 'key in extra' (:1150), and both call sites pass extra as a plain object literal, so inherited Object.prototype names (toString, constructor, proto) answer through the extra branch. That branch sits ahead of the guarded check at :1153-1156. No live bypass exists: the guarded names are inputSchema, aliases, and supports, none of which is an Object.prototype member.
Why deferral is safe
No incorrect behavior with a consequence today, so this is hardening against a future guarded field whose name collides with an Object.prototype member (for example constructor), which would be served from extra and silently skip the frozen copy. Pre-existing structure (the old code gave extra the same precedence over the supports branch). The one-word fix, Object.hasOwn(extra, prop), also changes String(view) from '[object Object]' to a throw, which is more than PR 2042 should carry.
Acceptance condition
answers/read use an own-property check (Object.hasOwn) for extra, with a test showing a guarded field named after an Object.prototype member still answers with a frozen copy, and a decision recorded for what String(view) should do afterwards.
Review preference; backlog only. A human may explicitly delegate it with neutral:fix.
- Dominant language
- JavaScript
- Stars
- 11
- Forks
- 0
- Avg merge
- 2h 55m
- Merged PRs (30d)
- 294
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from hyparam/hypaware
-
neutral:fix
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
report_commands.js runtime output still says 'server' in four places; one names the destinationOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 76/100
Maintainers usually reply within 1 day
All issues in hyparam/hypaware
Similar issues
-
ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
LucasSantana-Dev/Lucky#2945 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
brijeshb42/monaco-vim#175 ·
-
good first issue
Difficulty 2/5 3-5 days Newbie friendliness 62/100
paipai1999/POS-system#3 ·
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
r-afael/better-yt-recommendations#36 ·
Maintainers usually reply within 1 day
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
microsoft/playwright#43875 · 1 comment ·
Maintainers usually reply within 1 day