Skip to content

fix(security): 2 improvements across 2 files #1681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tomaioo wants to merge 6 commits into
base: develop
Choose a base branch
from
+13 −5
Open

fix(security): 2 improvements across 2 files #1681

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6de904b
Deploying fix to the documentation (#1622)
sequba Feb 20, 2026
9a510a2
Deploy docs: AI integration landing pages (#1656)
sequba Apr 15, 2026
68ae691
Merge branch 'release/3.3.0'
sequba May 20, 2026
7774a5c
fix(security): 2 improvements across 2 files
tomaioo May 25, 2026
fd8eb55
fix(security): 2 improvements across 2 files
tomaioo May 25, 2026
0589d32
Merge branch 'develop' into fix/security/potential-prototype-pollutio…
sequba Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions src/Destroy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,18 @@
*/

export function objectDestroy(object: any) {
for (const [key, value] of Object.entries(object)) {
if (object === null || typeof object !== 'object') {
return
}
for (const key of Object.keys(object)) {
if (!Object.prototype.hasOwnProperty.call(object, key)) {
continue
}

@cursor cursor Bot May 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant hasOwnProperty check after Object.keys

Low Severity

The hasOwnProperty guard is redundant here because Object.keys() already returns only an object's own enumerable properties by specification. The condition !Object.prototype.hasOwnProperty.call(object, key) can never be true for keys returned by Object.keys(object), making this a dead branch that adds unnecessary complexity without any protective benefit.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit fd8eb55. Configure here.

const value = object[key]
if (value instanceof Function) {
(object as Record<string, any>)[key] = postMortem(value)
object[key] = postMortem(value)
} else {
delete (object as Record<string, any>)[key]
delete object[key]
}
}
}
Expand Down
5 changes: 3 additions & 2 deletions src/NumberLiteralHelper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@ export class NumberLiteralHelper {
constructor(
private readonly config: Config
) {
const thousandSeparator = this.config.thousandSeparator === '.' ? `\\${this.config.thousandSeparator}` : this.config.thousandSeparator
const decimalSeparator = this.config.decimalSeparator === '.' ? `\\${this.config.decimalSeparator}` : this.config.decimalSeparator
const escapeRegex = (str: string): string => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
const thousandSeparator = escapeRegex(this.config.thousandSeparator)
const decimalSeparator = escapeRegex(this.config.decimalSeparator)

this.numberPattern = new RegExp(`^([+-]?((${decimalSeparator}\\d+)|(\\d+(${thousandSeparator}\\d{3,})*(${decimalSeparator}\\d*)?)))([eE][+-]?\\d+)?$`)
this.allThousandSeparatorsRegex = new RegExp(`${thousandSeparator}`, 'g')
Expand Down
Loading