Commit Graph
4 Commits
Author SHA1 Message Date
Yang JunandCursor 04354ce36f fix: revert ownPropertyOnly iteration hardening
Iteration is documented as an ownPropertyOnly exception; restore
isIterable/toEnumerable and document inherited Symbol.iterator behavior.

Co-authored-by: Cursor <[email protected]>
2026-07-19 14:00:05 +08:00
Yang JunandCursor 072f63c2c0 fix: tie proto key blocking to ownPropertyOnly policy
Block __proto__, constructor, and prototype only when ownPropertyOnly
is true or when access would traverse the prototype chain. Allow own
properties with those names when ownPropertyOnly is false.

Co-authored-by: Cursor <[email protected]>
2026-07-19 13:54:43 +08:00
Yang JunandCursor 3c385f74ec feat: harden scope writes, iteration, and readSize (#898)
Block writes to dangerous keys in assign/capture/increment/decrement, use own-property Symbol.iterator for plain objects when ownPropertyOnly is true, fix inherited size reads, and sanitize filter iteration scopes.

Co-authored-by: Cursor <[email protected]>
2026-07-18 19:58:14 +08:00
Yang JunandCursor 6bdf65a6a1 feat: block dangerous scope keys and harden findScope (#898)
Co-authored-by: Cursor <[email protected]>
2026-07-15 23:02:06 +08:00