Commit Graph
6 Commits
Author SHA1 Message Date
Yang JunandCursor aa58a45021 test: trim redundant scope-security integration tests
Co-authored-by: Cursor <[email protected]>
2026-07-19 23:38:54 +08:00
Yang JunandCursor cbc317508b fix: unify blocked-key checks in findScope
Use shouldBlockScopeKeyRead in findScope hasKey so inherited
constructor/__proto__/prototype do not falsely match environments.
Remove redundant globals hasKey check; globals remains the fallback scope.

Co-authored-by: Cursor <[email protected]>
2026-07-19 14:09:46 +08:00
Yang JunandCursor 04354ce36f fix: revert ownPropertyOnly iteration hardening
Iteration is documented as an ownPropertyOnly exception; restore
isIterable/toEnumerable and document inherited Symbol.iterator behavior.

Co-authored-by: Cursor <[email protected]>
2026-07-19 14:00:05 +08:00
Yang JunandCursor 072f63c2c0 fix: tie proto key blocking to ownPropertyOnly policy
Block __proto__, constructor, and prototype only when ownPropertyOnly
is true or when access would traverse the prototype chain. Allow own
properties with those names when ownPropertyOnly is false.

Co-authored-by: Cursor <[email protected]>
2026-07-19 13:54:43 +08:00
Yang JunandCursor 3c385f74ec feat: harden scope writes, iteration, and readSize (#898)
Block writes to dangerous keys in assign/capture/increment/decrement, use own-property Symbol.iterator for plain objects when ownPropertyOnly is true, fix inherited size reads, and sanitize filter iteration scopes.

Co-authored-by: Cursor <[email protected]>
2026-07-18 19:58:14 +08:00
Yang JunandCursor 6bdf65a6a1 feat: block dangerous scope keys and harden findScope (#898)
Co-authored-by: Cursor <[email protected]>
2026-07-15 23:02:06 +08:00