root
/
webpack
mirror of https://github.com/webpack/webpack.git
1
0
Fork 0
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix: JSON generator now preserves `__proto__` property (#19232)

This commit is contained in:
Alexander Akait 2025-02-14 23:57:39 +03:00 committed by GitHub
parent e3092e5d7e
commit 7168389ac6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/json/JsonGenerator.js
View File

@ -178,7 +178,7 @@ class JsonGenerator extends Generator {
const jsonExpr =
jsonStr.length > 20 && typeof finalJson === "object"
? `/*#__PURE__*/JSON.parse('${jsonStr.replace(/[\\']/g, "\\$&")}')`
: jsonStr;
: jsonStr.replace(/"__proto__":/g, '["__proto__"]:');
/** @type {string} */
let content;
if (concatenationScope) {

1
test/configCases/json/proto/data.json Normal file
View File

@ -0,0 +1 @@
{"__proto__":{}}

5
test/configCases/json/proto/data1.json Normal file
View File

@ -0,0 +1,5 @@
{
"__proto__": {
"fail": true
}
}

15
test/configCases/json/proto/index.js Normal file
View File

@ -0,0 +1,15 @@
import data from './data.json';
import data2 from 'data:application/json,{"__proto__":{}}';
import data3 from './data1.json';
import data4 from 'data:application/json,{"a":"__proto__"}';
it("should preserves `__proto__` properties", () => {
expect(Object.getPrototypeOf(data) === Object.getPrototypeOf({})).toBe(true);
expect(Object.getPrototypeOf(data2) === Object.getPrototypeOf({})).toBe(true);
expect(Object.getPrototypeOf(data3) === Object.getPrototypeOf({})).toBe(true);
expect(Object.getPrototypeOf(data4) === Object.getPrototypeOf({})).toBe(true);
expect(data).toMatchObject({["__proto__"]: {}});
expect(data2).toMatchObject({["__proto__"]: {}});
expect(data3.__proto__.fail).toBe(true);
expect(data4.a).toBe("__proto__");
});

5
test/configCases/json/proto/webpack.config.js Normal file
View File

@ -0,0 +1,5 @@
/** @type {import("../../../../").Configuration} */
module.exports = {
devtool: false,
mode: "development"
};