From d32da499255c8abc504460f372bd1797a9481de2 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Thu, 23 Jul 2026 22:50:10 +0800 Subject: [PATCH] fix: clarify blocked key checks in readJSProperty Split the OR condition into two explicit checks so inherited proto keys are always blocked and own proto keys are blocked only when ownPropertyOnly is true. Co-authored-by: Cursor --- src/context/context.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/context/context.ts b/src/context/context.ts index 959a1d8f2..872088615 100644 --- a/src/context/context.ts +++ b/src/context/context.ts @@ -159,7 +159,8 @@ const BLOCKED_SCOPE_KEYS: ReadonlySet = new Set(['__proto__', 'cons export function readJSProperty (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean) { if (BLOCKED_SCOPE_KEYS.has(key)) { - if (ownPropertyOnly || !hasOwnProperty.call(obj, key)) return undefined + if (!hasOwnProperty.call(obj, key)) return undefined + if (ownPropertyOnly) return undefined } if (ownPropertyOnly && !hasOwnProperty.call(obj, key) && !(obj instanceof Drop)) return undefined return obj[key]