Skip to content

tools: update prototype-pollution rule to accept null proto obj - #66680

Open
jasnell wants to merge 1 commit into
nodejs:mainfrom
jasnell:jasnell/update-proto-lint-rule
Open

jasnell wants to merge 1 commit into
nodejs:mainfrom
jasnell:jasnell/update-proto-lint-rule

Conversation

@jasnell

@jasnell jasnell commented Oct 12, 2026

Copy link
Copy Markdown
Member

Allow for...

const kNullProtoObject = Object.freeze({ __proto__: null });
const obj = { __proto__: kNullProtoObject, ... };

Refs: #66678

Allow for...

```js
const kNullProtoObject = Object.freeze({ __proto__: null });
const obj = { __proto__: kNullProtoObject, ... };
```

Signed-off-by: James M Snell <jasnell@gmail.com>
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. tools Issues and PRs related to the tools directory. labels Oct 12, 2026

@aduh95 aduh95 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we simplify this a LOT by re-using kEmptyObject (and have the lint rule accept either __proto__: null or __proto__: kEmptyObject?

@codecov

codecov Bot commented Oct 12, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.48%. Comparing base (04bd737) to head (e601d34).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #66680      +/-   ##
==========================================
+ Coverage   90.47%   90.48%   +0.01%     
==========================================
  Files         791      791              
  Lines      277097   277088       -9     
  Branches    53277    53280       +3     
==========================================
+ Hits       250696   250725      +29     
+ Misses      16813    16767      -46     
- Partials     9588     9596       +8     

see 34 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ci PRs that need a full CI run. tools Issues and PRs related to the tools directory.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants