Skip to content

fix(i18n): use own-property checks for placeholder and key resolution #194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JosunLP merged 1 commit into from
Jul 6, 2026
Merged

fix(i18n): use own-property checks for placeholder and key resolution #194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions src/i18n/icu.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,14 @@ export const isICUMessage = (template: string): boolean =>

const isNameChar = (ch: string): boolean => /[A-Za-z0-9_]/.test(ch);

/**
* Own-property check for argument lookup, so a placeholder name colliding with
* an inherited `Object.prototype` member (`toString`, `constructor`, …) is not
* treated as present.
*/
const hasParam = (params: TranslateParams, name: string): boolean =>
Object.prototype.hasOwnProperty.call(params, name);

/**
* Parses a message pattern starting at `pos`, stopping at the first
* unbalanced `}` (when nested inside an argument) or end of input.
Expand Down Expand Up @@ -277,18 +285,18 @@ const render = (
break;

case 'arg':
out += node.name in params ? String(params[node.name]) : `{${node.name}}`;
out += hasParam(params, node.name) ? String(params[node.name]) : `{${node.name}}`;
break;

case 'select': {
const value = node.name in params ? String(params[node.name]) : 'other';
const value = hasParam(params, node.name) ? String(params[node.name]) : 'other';
const chosen = node.cases.get(value) ?? node.cases.get('other') ?? [];
out += render(chosen, params, locale, poundValue);
break;
}

case 'plural': {
const raw = Number(params[node.name]);
const raw = hasParam(params, node.name) ? Number(params[node.name]) : NaN;
const value = Number.isFinite(raw) ? raw : 0;
const adjusted = value - node.offset;

Expand Down
8 changes: 7 additions & 1 deletion src/i18n/translate.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ export const resolveKey = (messages: LocaleMessages, key: string): string | unde

for (const part of parts) {
if (typeof current === 'string') return undefined;
// Own-property check: never resolve inherited prototype members
// (`toString`, `constructor`, `__proto__`, …) as message segments.
if (!Object.prototype.hasOwnProperty.call(current, part)) return undefined;
if (current[part] === undefined) return undefined;
current = current[part];
}
Expand All @@ -47,7 +50,10 @@ export const resolveKey = (messages: LocaleMessages, key: string): string | unde
*/
export const interpolate = (template: string, params: TranslateParams): string => {
return template.replace(/\{(\w+)\}/g, (match, key: string) => {
if (key in params) {
// Own-property check so a placeholder colliding with an inherited member
// (`toString`, `valueOf`, …) is left intact rather than substituted with
// the inherited value.
if (Object.prototype.hasOwnProperty.call(params, key)) {
return String(params[key]);
}
return match; // Leave unmatched placeholders as-is
Expand Down
22 changes: 22 additions & 0 deletions tests/i18n.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -666,3 +666,25 @@ describe('i18n/module exports', () => {
expect(typeof mod.formatDate).toBe('function');
});
});

describe('i18n prototype-chain hardening (#174)', () => {
it('leaves a placeholder colliding with an Object.prototype member intact', async () => {
const { interpolate } = await import('../src/i18n/translate');
expect(interpolate('Hello {toString}', {})).toBe('Hello {toString}');
expect(interpolate('X {constructor} Y', {})).toBe('X {constructor} Y');
// A real param still substitutes.
expect(interpolate('Hello {toString}', { toString: 'ok' })).toBe('Hello ok');
});

it('does not resolve inherited members as message key segments', async () => {
const { resolveKey } = await import('../src/i18n/translate');
expect(resolveKey({ greeting: 'hi' }, 'toString')).toBeUndefined();
expect(resolveKey({ greeting: 'hi' }, 'constructor.name')).toBeUndefined();
});

it('leaves ICU arg/select placeholders intact for inherited names', async () => {
const { formatMessage } = await import('../src/i18n/define');
expect(formatMessage('{toString}', {})).toBe('{toString}');
expect(formatMessage('{hasOwnProperty, select, other {none}}', {})).toBe('none');
});
});