fix #610 ignore properties set to Object.prototype

amitguptagwl · amitguptagwl · commit 145521ebd285 · 2023-09-20T09:27:59.000+05:30
diff --git a/spec/html_spec.js b/spec/html_spec.js
@@ -4,7 +4,8 @@ const {XMLParser, XMLBuilder} = require("../src/fxp");
 describe("XMLParser", function() {
 
     it("should parse HTML with basic entities, <pre>, <script>, <br>", function() {
-        const html = `
+      Object.prototype.something = 'strange';
+      const html = `
         <html lang="en">
             <head>
                 <script>
diff --git a/spec/j2x_ordered_spec.js b/spec/j2x_ordered_spec.js
@@ -247,6 +247,7 @@ describe("XMLBuilder", function () {
     });
 
     it("should build XML when leaf nodes or attributes are parsed to array", function () {
+        Object.prototype.something = 'strange';
         const XMLdata = `<report>
         <store>
             <region>US</region>
diff --git a/spec/j2x_spec.js b/spec/j2x_spec.js
@@ -624,5 +624,14 @@ describe("XMLBuilder", function() {
 
         expect(result).toEqual(expected);
     });
+    it("should ignore Object level prototype properties or function", function () {
+        Object.prototype.something = 'strange';
+        const jObj = { a: 1 }
+        const builder = new XMLBuilder();
+        const result = builder.build(jObj);
+        const expected = `<a>1</a>`;
+
+        expect(result).toEqual(expected);
+    });
 
 });
diff --git a/src/xmlbuilder/json2xml.js b/src/xmlbuilder/json2xml.js
@@ -79,6 +79,7 @@ Builder.prototype.j2x = function(jObj, level) {
   let attrStr = '';
   let val = '';
   for (let key in jObj) {
+    if(!jObj.hasOwnProperty(key)) continue;
     if (typeof jObj[key] === 'undefined') {
       // supress undefined node only if it is not an attribute
       if (this.isAttribute(key)) {
diff --git a/src/xmlbuilder/orderedJs2Xml.js b/src/xmlbuilder/orderedJs2Xml.js
@@ -21,6 +21,8 @@ function arrToStr(arr, options, jPath, indentation) {
     for (let i = 0; i < arr.length; i++) {
         const tagObj = arr[i];
         const tagName = propName(tagObj);
+        if(tagName === undefined) continue;
+
         let newJPath = "";
         if (jPath.length === 0) newJPath = tagName
         else newJPath = `${jPath}.${tagName}`;
@@ -90,6 +92,7 @@ function propName(obj) {
     const keys = Object.keys(obj);
     for (let i = 0; i < keys.length; i++) {
         const key = keys[i];
+        if(!obj.hasOwnProperty(key)) continue;
         if (key !== ":@") return key;
     }
 }
@@ -98,6 +101,7 @@ function attr_to_str(attrMap, options) {
     let attrStr = "";
     if (attrMap && !options.ignoreAttributes) {
         for (let attr in attrMap) {
+            if(!attrMap.hasOwnProperty(attr)) continue;
             let attrVal = options.attributeValueProcessor(attr, attrMap[attr]);
             attrVal = replaceEntitiesValue(attrVal, options);
             if (attrVal === true && options.suppressBooleanAttributes) {
