Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

assertObjectMatch is not able to test target object's own __proto__ #6341

Closed
yuhr opened this issue Jan 10, 2025 · 0 comments · Fixed by #6342
Closed

assertObjectMatch is not able to test target object's own __proto__ #6341

yuhr opened this issue Jan 10, 2025 · 0 comments · Fixed by #6342
Labels
bug Something isn't working needs triage

Comments

@yuhr
Copy link
Contributor

yuhr commented Jan 10, 2025

Describe the bug

As the title says. assertEquals does work expectedly but assertObjectMatch does not.

Steps to Reproduce

  1. Create a file named test.ts with the content being:

    import { assertObjectMatch, assertEquals } from "jsr:@std/[email protected]"
    
    Deno.test("assertEquals", async t => {
    	await t.step("should be able to test target object's own `__proto__`", async t => {
    		const objectA = { ["__proto__"]: { polluted: true } }
    		const objectB = { ["__proto__"]: { polluted: true } }
    		assertEquals(objectA, objectB)
    	})
    })
    
    Deno.test("assertObjectMatch", async t => {
    	await t.step("should be able to test target object's own `__proto__`", async t => {
    		const objectA = { ["__proto__"]: { polluted: true } }
    		const objectB = { ["__proto__"]: { polluted: true } }
    		assertObjectMatch(objectA, objectB)
    	})
    })
  2. Execute the command deno test --unstable-unsafe-proto test.ts

  3. See error is like this:

    assertEquals ...
      should be able to test target object's own `__proto__` ... ok (0ms)
    assertEquals ... ok (0ms)
    assertObjectMatch ...
      should be able to test target object's own `__proto__` ... FAILED (1ms)
    assertObjectMatch ... FAILED (due to 1 failed step) (2ms)
    

    And the diff is even unhelpful:

    error: AssertionError: Values are not equal.
    
    
        [Diff] Actual / Expected
    
    
        {}
    
      throw new AssertionError(message);
            ^
    

Expected behavior

The test case successfully passes.

For normal users the infamous __proto__ should be disabled by default, but as a library author I want to test our APIs are immune to the behavior, but currently I can't use assignObjectMatch for it due to this bug.

Environment

  • OS: macOS Sequoia 15.0
  • deno version: deno 2.1.4 (stable, release, aarch64-apple-darwin)
  • std version: @std/[email protected]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working needs triage
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant