Throw only if the constructor key has a child named prototype

[delvedor]

Currently, we are throwing an error for a valid use case, eg:

{
  "constructor": {
    "foo": "bar
  }
}

While we should only throw if the constructor key has a direct prototype child.

{
  "constructor": {
    "prototype": {
      "foo": "bar
    }
  }
}

I'm still checking if there are some edge cases that need to be covered, or if this change will introduce any regression.

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[mcollina]

lgtm

[jsumners]

LGTM

[RafaelGSS]

LGTM.

[delvedor]

@fastify/core I'm wondering if we should remove the whole constructor object or only the constructor.prototype:

secure-json-parse/index.js

Line 86 in 4a39a3c

delete node.constructor

What do you think?

[mcollina]

I would remove also constructor. We can safely assume that anyone doing those things is an attacker.