Skip to content

Commit

Permalink
Merge pull request #17374 from jacobq/test-for-prototype-extension-re…
Browse files Browse the repository at this point in the history
…gression

[BUGFIX release] Fix cyclic references on Array.prototype
  • Loading branch information
rwjblue authored Dec 15, 2018
2 parents bcd9a64 + 6e74ef8 commit 98bdc39
Show file tree
Hide file tree
Showing 2 changed files with 48 additions and 5 deletions.
22 changes: 17 additions & 5 deletions packages/@ember/-internals/runtime/lib/mixins/array.js
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,18 @@ export function isArray(_obj) {
return false;
}

/*
This allows us to define computed properties that are not enumerable.
The primary reason this is important is that when `NativeArray` is
applied to `Array.prototype` we need to ensure that we do not add _any_
new enumerable properties.
*/
function nonEnumerableComputed() {
let property = computed(...arguments);
property.enumerable = false;
return property;
}

// ..........................................................
// ARRAY
//
Expand Down Expand Up @@ -273,7 +285,7 @@ const ArrayMixin = Mixin.create(Enumerable, {
@return this
@public
*/
'[]': computed({
'[]': nonEnumerableComputed({
get() {
return this;
},
Expand All @@ -290,7 +302,7 @@ const ArrayMixin = Mixin.create(Enumerable, {
@return {Object | undefined} The first object in the array
@public
*/
firstObject: computed(function() {
firstObject: nonEnumerableComputed(function() {
return objectAt(this, 0);
}).readOnly(),

Expand All @@ -301,7 +313,7 @@ const ArrayMixin = Mixin.create(Enumerable, {
@return {Object | undefined} The last object in the array
@public
*/
lastObject: computed(function() {
lastObject: nonEnumerableComputed(function() {
return objectAt(this, this.length - 1);
}).readOnly(),

Expand Down Expand Up @@ -474,7 +486,7 @@ const ArrayMixin = Mixin.create(Enumerable, {
@property {Boolean} hasArrayObservers
@public
*/
hasArrayObservers: computed(function() {
hasArrayObservers: nonEnumerableComputed(function() {
return hasListeners(this, '@array:change') || hasListeners(this, '@array:before');
}),

Expand Down Expand Up @@ -1154,7 +1166,7 @@ const ArrayMixin = Mixin.create(Enumerable, {
@public
*/
'@each': ARRAY_AT_EACH
? computed(function() {
? nonEnumerableComputed(function() {
deprecate(`Getting the '@each' property on object ${toString(this)} is deprecated`, false, {
id: 'ember-metal.getting-each',
until: '3.5.0',
Expand Down
31 changes: 31 additions & 0 deletions packages/@ember/-internals/runtime/tests/array/apply-test.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
import { NativeArray } from '../../lib/mixins/array';
import { AbstractTestCase, moduleFor } from 'internal-test-helpers';

class ArrayPrototypeExtensionSelfReferenceTests extends AbstractTestCase {
'@test should not create non-Symbol, enumerable properties that refer to itself'() {
// Don't want to pollute Array.prototype so we make a fake / simple prototype
function ThrowAwayArray() {}

// Extend our throw-away prototype (like EXTEND_PROTOTYPES.Array would)
NativeArray.apply(ThrowAwayArray.prototype);

// Create an instance to test
let obj = new ThrowAwayArray();

// Make sure that no enumerable properties refer back to the object (creating a cyclic structure)
for (let p in obj) {
this.assert.notStrictEqual(
obj[p],
obj,
`Property "${p}" is an enumerable part of the prototype
so must not refer back to the original array.
Otherwise code that explores all properties,
such as jQuery.extend and other "deep cloning" functions,
will get stuck in an infinite loop.
`.replace(/\s+/g, ' ')
);
}
}
}

moduleFor(`NativeArray: apply`, ArrayPrototypeExtensionSelfReferenceTests);

0 comments on commit 98bdc39

Please sign in to comment.