fix: do not trust spoofable Symbol.toStringTag in type dispatch

Every mode (src/index.js, src/full.js, src/lite.js, src/json.js)
picked its clone strategy from Object.prototype.toString.call(x),
which reads a user-settable Symbol.toStringTag. A plain object
declaring a recognized tag (eg "Map") was routed into that type's
clone branch and crashed on methods it doesn't have; one with an
unrecognized tag fell through every branch and was returned by
reference instead of cloned.

Also check the object's real constructor, which Symbol.toStringTag
cannot affect, so a plain object (or one with no prototype) is still
deep-cloned as a plain object no matter what tag it claims.

Fixes #54

src/full.js

@@ -10,7 +10,13 @@ export function klona(x) {
 
 	var i=0, k, list, tmp, str=Object.prototype.toString.call(x);
 
-	if (str === '[object Object]') {
+	// `str` trusts `Symbol.toStringTag`, which any object can set to spoof
+	// a recognized type and get misrouted below (crash), or set to an
+	// unrecognized value and fall through to `return x` (reference leak).
+	// `constructor` is unaffected by that spoofing, so also treat a plain
+	// object (or one with no prototype) as `[object Object]` regardless of
+	// what `str` claims. @see https://github.com/lukeed/klona/issues/54
+	if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) {
 		tmp = Object.create(x.__proto__ || null);
 	} else if (str === '[object Array]') {
 		tmp = Array(x.length);

src/index.js

@@ -3,7 +3,13 @@ export function klona(x) {
 
 	var k, tmp, str=Object.prototype.toString.call(x);
 
-	if (str === '[object Object]') {
+	// `str` trusts `Symbol.toStringTag`, which any object can set to spoof
+	// a recognized type and get misrouted below (crash), or set to an
+	// unrecognized value and fall through to `return x` (reference leak).
+	// `constructor` is unaffected by that spoofing, so also treat a plain
+	// object (or one with no prototype) as `[object Object]` regardless of
+	// what `str` claims. @see https://github.com/lukeed/klona/issues/54
+	if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) {
 		if (x.constructor !== Object && typeof x.constructor === 'function') {
 			tmp = new x.constructor();
 			for (k in x) {

src/json.js

@@ -7,7 +7,13 @@ export function klona(val) {
 		return out;
 	}
 
-	if (Object.prototype.toString.call(val) === '[object Object]') {
+	// `Object.prototype.toString` trusts `Symbol.toStringTag`, which any
+	// object can set to an unrecognized value and fall through to
+	// `return val` below (reference leak). `constructor` is unaffected by
+	// that spoofing, so also treat a plain object (or one with no
+	// prototype) as an object regardless of what the tag claims.
+	// @see https://github.com/lukeed/klona/issues/54
+	if (Object.prototype.toString.call(val) === '[object Object]' || (val && (val.constructor === Object || val.constructor == null))) {
 		out = {}; // null
 		for (k in val) {
 			if (k === '__proto__') {

src/lite.js

@@ -3,7 +3,13 @@ export function klona(x) {
 
 	var k, tmp, str=Object.prototype.toString.call(x);
 
-	if (str === '[object Object]') {
+	// `str` trusts `Symbol.toStringTag`, which any object can set to an
+	// unrecognized value and fall through to `return x` below (reference
+	// leak). `constructor` is unaffected by that spoofing, so also treat a
+	// plain object (or one with no prototype) as `[object Object]`
+	// regardless of what `str` claims.
+	// @see https://github.com/lukeed/klona/issues/54
+	if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) {
 		if (x.constructor !== Object && typeof x.constructor === 'function') {
 			tmp = new x.constructor();
 			for (k in x) {

test/full.js

@@ -13,6 +13,7 @@ suites.RegExps(klona);
 
 suites.Objects(klona);
 suites.Arrays(klona);
+suites.ToStringTag(klona);
 
 suites.Functions(klona);
 suites.Pollutions(klona);

test/index.js

@@ -13,6 +13,7 @@ suites.RegExps(klona);
 
 suites.Objects(klona);
 suites.Arrays(klona);
+suites.ToStringTag(klona);
 
 suites.Functions(klona);
 suites.Pollutions(klona);

test/json.js

@@ -10,5 +10,6 @@ suites.Nully(klona);
 
 suites.Objects(klona);
 suites.Arrays(klona);
+suites.ToStringTag(klona);
 
 suites.Pollutions(klona);

test/lite.js

@@ -13,6 +13,7 @@ suites.RegExps(klona);
 
 suites.Objects(klona);
 suites.Arrays(klona);
+suites.ToStringTag(klona);
 
 suites.Functions(klona);
 suites.Pollutions(klona);

test/suites/index.js

@@ -11,6 +11,7 @@ export { default as Sets } from './set';
 export { default as TypedArrays } from './typedarray';
 export { default as Descriptors } from './descriptor';
 export { default as Symbols } from './symbol';
+export { default as ToStringTag } from './tostringtag';
 
 export { default as Dates } from './date';
 export { default as RegExps } from './regexp';

test/suites/tostringtag.js

@@ -0,0 +1,44 @@
+import { suite } from 'uvu';
+import * as assert from 'assert';
+
+export default function (klona) {
+	const Spoofed = suite('Symbol.toStringTag spoofing');
+
+	// A plain object can set `Symbol.toStringTag` to a value that klona
+	// *does* special-case (eg, "Map"), which used to misroute it into that
+	// type's clone branch and crash on methods it doesn't have.
+	// @see https://github.com/lukeed/klona/issues/54
+	Spoofed('recognized tag :: plain object is cloned, not misrouted', () => {
+		const input = { a: 1, b: { c: 2 }, [Symbol.toStringTag]: 'Map' };
+		const output = klona(input);
+
+		assert.notEqual(output, input, 'must return a new object, not the input');
+		assert.equal(output.a, 1);
+		assert.deepEqual(output.b, { c: 2 });
+
+		output.a = 999;
+		output.b.c = 888;
+		assert.equal(input.a, 1, 'mutating output.a must not affect input');
+		assert.equal(input.b.c, 2, 'mutating output.b must not affect input');
+	});
+
+	// A plain object can set `Symbol.toStringTag` to a value klona does
+	// *not* special-case (eg, an arbitrary string), which used to fall
+	// through every branch and get returned by reference instead of cloned.
+	// @see https://github.com/lukeed/klona/issues/54
+	Spoofed('unrecognized tag :: plain object is cloned, not returned by reference', () => {
+		const input = { a: 1, b: { c: 2 }, [Symbol.toStringTag]: 'Foobar' };
+		const output = klona(input);
+
+		assert.notEqual(output, input, 'must return a new object, not the input');
+		assert.equal(output.a, 1);
+		assert.deepEqual(output.b, { c: 2 });
+
+		output.a = 999;
+		output.b.c = 888;
+		assert.equal(input.a, 1, 'mutating output.a must not affect input');
+		assert.equal(input.b.c, 2, 'mutating output.b must not affect input');
+	});
+
+	Spoofed.run();
+}