From e65d94875ed9ad2f464c6cc01e019709704165d7 Mon Sep 17 00:00:00 2001 From: DualFroz Date: Fri, 4 Sep 2026 05:12:29 +0200 Subject: [PATCH] fix: do not trust spoofable Symbol.toStringTag in type dispatch Every mode (src/index.js, src/full.js, src/lite.js, src/json.js) picked its clone strategy from Object.prototype.toString.call(x), which reads a user-settable Symbol.toStringTag. A plain object declaring a recognized tag (eg "Map") was routed into that type's clone branch and crashed on methods it doesn't have; one with an unrecognized tag fell through every branch and was returned by reference instead of cloned. Also check the object's real constructor, which Symbol.toStringTag cannot affect, so a plain object (or one with no prototype) is still deep-cloned as a plain object no matter what tag it claims. Fixes #54 --- src/full.js | 2 +- src/index.js | 2 +- src/json.js | 2 +- src/lite.js | 2 +- test/full.js | 1 + test/index.js | 1 + test/json.js | 1 + test/lite.js | 1 + test/suites/index.js | 1 + test/suites/tostringtag.js | 42 ++++++++++++++++++++++++++++++++++++++ 10 files changed, 51 insertions(+), 4 deletions(-) create mode 100644 test/suites/tostringtag.js diff --git a/src/full.js b/src/full.js index b5f86c3..e8e9e1a 100644 --- a/src/full.js +++ b/src/full.js @@ -10,7 +10,7 @@ export function klona(x) { var i=0, k, list, tmp, str=Object.prototype.toString.call(x); - if (str === '[object Object]') { + if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) { tmp = Object.create(x.__proto__ || null); } else if (str === '[object Array]') { tmp = Array(x.length); diff --git a/src/index.js b/src/index.js index 4b866ba..a6a1944 100644 --- a/src/index.js +++ b/src/index.js @@ -3,7 +3,7 @@ export function klona(x) { var k, tmp, str=Object.prototype.toString.call(x); - if (str === '[object Object]') { + if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) { if (x.constructor !== Object && typeof x.constructor === 'function') { tmp = new x.constructor(); for (k in x) { diff --git a/src/json.js b/src/json.js index eae543d..00fc257 100644 --- a/src/json.js +++ b/src/json.js @@ -7,7 +7,7 @@ export function klona(val) { return out; } - if (Object.prototype.toString.call(val) === '[object Object]') { + if (Object.prototype.toString.call(val) === '[object Object]' || (val && (val.constructor === Object || val.constructor == null))) { out = {}; // null for (k in val) { if (k === '__proto__') { diff --git a/src/lite.js b/src/lite.js index bbd342e..f54121e 100644 --- a/src/lite.js +++ b/src/lite.js @@ -3,7 +3,7 @@ export function klona(x) { var k, tmp, str=Object.prototype.toString.call(x); - if (str === '[object Object]') { + if (str === '[object Object]' || (x && (x.constructor === Object || x.constructor == null))) { if (x.constructor !== Object && typeof x.constructor === 'function') { tmp = new x.constructor(); for (k in x) { diff --git a/test/full.js b/test/full.js index 816a9b7..3f665eb 100644 --- a/test/full.js +++ b/test/full.js @@ -13,6 +13,7 @@ suites.RegExps(klona); suites.Objects(klona); suites.Arrays(klona); +suites.ToStringTag(klona); suites.Functions(klona); suites.Pollutions(klona); diff --git a/test/index.js b/test/index.js index 46470d4..4a33445 100644 --- a/test/index.js +++ b/test/index.js @@ -13,6 +13,7 @@ suites.RegExps(klona); suites.Objects(klona); suites.Arrays(klona); +suites.ToStringTag(klona); suites.Functions(klona); suites.Pollutions(klona); diff --git a/test/json.js b/test/json.js index d32a942..57e2469 100644 --- a/test/json.js +++ b/test/json.js @@ -10,5 +10,6 @@ suites.Nully(klona); suites.Objects(klona); suites.Arrays(klona); +suites.ToStringTag(klona); suites.Pollutions(klona); diff --git a/test/lite.js b/test/lite.js index a406dc3..7d68557 100644 --- a/test/lite.js +++ b/test/lite.js @@ -13,6 +13,7 @@ suites.RegExps(klona); suites.Objects(klona); suites.Arrays(klona); +suites.ToStringTag(klona); suites.Functions(klona); suites.Pollutions(klona); diff --git a/test/suites/index.js b/test/suites/index.js index 7d5ccfc..800a093 100644 --- a/test/suites/index.js +++ b/test/suites/index.js @@ -11,6 +11,7 @@ export { default as Sets } from './set'; export { default as TypedArrays } from './typedarray'; export { default as Descriptors } from './descriptor'; export { default as Symbols } from './symbol'; +export { default as ToStringTag } from './tostringtag'; export { default as Dates } from './date'; export { default as RegExps } from './regexp'; diff --git a/test/suites/tostringtag.js b/test/suites/tostringtag.js new file mode 100644 index 0000000..5844d77 --- /dev/null +++ b/test/suites/tostringtag.js @@ -0,0 +1,42 @@ +import { suite } from 'uvu'; +import * as assert from 'assert'; + +export default function (klona) { + const Spoofed = suite('Symbol.toStringTag spoofing'); + + // A `Symbol.toStringTag` klona special-cases (eg "Map") used to misroute a + // plain object into that branch and crash. + // @see https://github.com/lukeed/klona/issues/54 + Spoofed('recognized tag :: plain object is cloned, not misrouted', () => { + const input = { a: 1, b: { c: 2 }, [Symbol.toStringTag]: 'Map' }; + const output = klona(input); + + assert.notEqual(output, input, 'must return a new object, not the input'); + assert.equal(output.a, 1); + assert.deepEqual(output.b, { c: 2 }); + + output.a = 999; + output.b.c = 888; + assert.equal(input.a, 1, 'mutating output.a must not affect input'); + assert.equal(input.b.c, 2, 'mutating output.b must not affect input'); + }); + + // An unrecognized `Symbol.toStringTag` used to fall through every branch + // and be returned by reference instead of cloned. + // @see https://github.com/lukeed/klona/issues/54 + Spoofed('unrecognized tag :: plain object is cloned, not returned by reference', () => { + const input = { a: 1, b: { c: 2 }, [Symbol.toStringTag]: 'Foobar' }; + const output = klona(input); + + assert.notEqual(output, input, 'must return a new object, not the input'); + assert.equal(output.a, 1); + assert.deepEqual(output.b, { c: 2 }); + + output.a = 999; + output.b.c = 888; + assert.equal(input.a, 1, 'mutating output.a must not affect input'); + assert.equal(input.b.c, 2, 'mutating output.b must not affect input'); + }); + + Spoofed.run(); +}