proto-test.js 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. const makeJSON = require('../index.js');
  2. const expect = require('chai').expect;
  3. describe('__proto__ and constructor assignment', function () {
  4. it('should set __proto__ property but not a prototype if protoAction is set to preserve', () => {
  5. const JSONbig = makeJSON({ protoAction: 'preserve' });
  6. const obj1 = JSONbig.parse('{ "__proto__": 1000000000000000 }');
  7. expect(Object.getPrototypeOf(obj1)).to.equal(null);
  8. const obj2 = JSONbig.parse('{ "__proto__": { "admin": true } }');
  9. expect(obj2.admin).to.not.equal(true);
  10. });
  11. it('should throw an exception if protoAction set to invalid value', () => {
  12. expect(() => {
  13. makeJSON({ protoAction: 'invalid value' });
  14. }).to.throw(
  15. 'Incorrect value for protoAction option, must be "error", "ignore" or undefined but passed invalid value'
  16. );
  17. });
  18. it('should throw an exception if constructorAction set to invalid value', () => {
  19. expect(() => {
  20. makeJSON({ constructorAction: 'invalid value' });
  21. }).to.throw(
  22. 'Incorrect value for constructorAction option, must be "error", "ignore" or undefined but passed invalid value'
  23. );
  24. });
  25. it('should throw an exception if protoAction set to error and there is __proto__ property', () => {
  26. const JSONbig = makeJSON({ protoAction: 'error' });
  27. expect(() =>
  28. JSONbig.parse('{ "\\u005f_proto__": 1000000000000000 }')
  29. ).to.throw('Object contains forbidden prototype property');
  30. });
  31. it('should throw an exception if constructorAction set to error and there is constructor property', () => {
  32. const JSONbig = makeJSON({ protoAction: 'error' });
  33. expect(() => JSONbig.parse('{ "constructor": 1000000000000000 }')).to.throw(
  34. 'Object contains forbidden constructor property'
  35. );
  36. });
  37. it('should ignore __proto__ property if protoAction is set to ignore', () => {
  38. const JSONbig = makeJSON({ protoAction: 'ignore' });
  39. const obj1 = JSONbig.parse(
  40. '{ "__proto__": 1000000000000000, "a" : 42, "nested": { "__proto__": false, "b": 43 } }'
  41. );
  42. expect(Object.getPrototypeOf(obj1)).to.equal(null);
  43. expect(obj1).to.deep.equal({ a: 42, nested: { b: 43 } });
  44. });
  45. it('should ignore constructor property if constructorAction is set to ignore', () => {
  46. const JSONbig = makeJSON({ constructorAction: 'ignore' });
  47. const obj1 = JSONbig.parse(
  48. '{ "constructor": 1000000000000000, "a" : 42, "nested": { "constructor": false, "b": 43 } }'
  49. );
  50. expect(obj1).to.deep.equal({ a: 42, nested: { b: 43 } });
  51. });
  52. });