noPrototypeBuiltins
诊断类别：lint/suspicious/noPrototypeBuiltins
¥Diagnostic Category: lint/suspicious/noPrototypeBuiltins
自从：v1.0.0
¥Since: v1.0.0
来源：
¥Sources:
-
与以下相同：
no-prototype-builtins¥Same as:
no-prototype-builtins
禁止直接使用 Object.prototype 内置函数。
¥Disallow direct use of Object.prototype builtins.
ECMAScript 5.1 添加了 Object.create，允许创建具有自定义原型的对象。此模式通常用于用作地图的对象。但是，如果其他东西依赖于原型属性/方法，则此模式可能会导致错误。此外，方法可能会被隐藏，这可能导致随机错误和拒绝服务漏洞。例如，像 {"hasOwnProperty": 1} 一样直接在解析的 JSON 上调用 hasOwnProperty 可能会导致漏洞。为了避免出现此类细微错误，你应该从 Object.prototype 调用这些方法。例如，foo.isPrototypeOf(bar) 应该替换为 Object.prototype.isPrototypeOf.call(foo, "bar") 至于 hasOwn 方法，foo.hasOwn("bar") 应该替换为 Object.hasOwn(foo, "bar")。
¥ECMAScript 5.1 added Object.create which allows the creation of an object with a custom prototype.
This pattern is often used for objects used as Maps. However, this pattern can lead to errors
if something else relies on prototype properties/methods.
Moreover, the methods could be shadowed, this can lead to random bugs and denial of service
vulnerabilities. For example, calling hasOwnProperty directly on parsed JSON like {"hasOwnProperty": 1} could lead to vulnerabilities.
To avoid subtle bugs like this, you should call these methods from Object.prototype.
For example, foo.isPrototypeOf(bar) should be replaced with Object.prototype.isPrototypeOf.call(foo, "bar")
As for the hasOwn method, foo.hasOwn("bar") should be replaced with Object.hasOwn(foo, "bar").
¥Examples
¥Invalid
var invalid = foo.hasOwnProperty("bar");code-block.js:1:19 lint/suspicious/noPrototypeBuiltins ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✖ Do not access Object.prototype method ‘hasOwnProperty’ from target object.
> 1 │ var invalid = foo.hasOwnProperty(“bar”);
│ ^^^^^^^^^^^^^^
2 │
ℹ It’s recommended using Object.hasOwn() instead of using Object.hasOwnProperty().
ℹ See MDN web docs for more details.
var invalid = foo.isPrototypeOf(bar);code-block.js:1:19 lint/suspicious/noPrototypeBuiltins ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✖ Do not access Object.prototype method ‘isPrototypeOf’ from target object.
> 1 │ var invalid = foo.isPrototypeOf(bar);
│ ^^^^^^^^^^^^^
2 │
var invalid = foo.propertyIsEnumerable("bar");code-block.js:1:19 lint/suspicious/noPrototypeBuiltins ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✖ Do not access Object.prototype method ‘propertyIsEnumerable’ from target object.
> 1 │ var invalid = foo.propertyIsEnumerable(“bar”);
│ ^^^^^^^^^^^^^^^^^^^^
2 │
¥Valid
var valid = Object.hasOwn(foo, "bar");var valid = Object.prototype.isPrototypeOf.call(foo, bar);var valid = {}.propertyIsEnumerable.call(foo, "bar");¥Related links