dot-prop
Get, set, or delete a property from a nested object using a dot path
by sindresorhusJavaScript
Commit activity
Last 12 weeks · 0 commits
Community health
4 of 6 standards met
Recent PRs & issues
Before: returns , and throws . is true, so prints the number as an index, but is in exponent notation, which the index parser does not accept. The readme says "Returns a string path that can be used with other dot-prop functions". After: returns and returns , which reads back as and : the number is treated as a string key, the same way non-integer and negative numbers already are. How: one extra condition () in , and a test in covering the round trip. The suite passes (). The fix and the test are on https://github.com/FengXiao1231/dot-prop/commits/fix-stringify-path-large-numbers (pull requests here are limited to collaborators, so I am opening an issue instead). Happy to adjust it.
When accessing a object using with an empty array, it currently returns the fallback value. This came to me as a surprise, isn't an empty string a zero nested path to the root object? https://github.com/sindresorhus/dot-prop/blob/8e81843270e42051ea8fda6035de1d638856fad5/index.js#L274-L277 Changing this would probably be a breaking change, but I think it would be more consistent.
Pull requests on this repo are limited to collaborators, so I'm offering this as an issue instead. covers and at the limit, but not . I have one test for it: an array with a value at index 1,000,001 must give the key , not . It is one commit that adds 10 lines to and does not touch : https://github.com/sindresorhus/dot-prop/compare/main...simpleciki:dot-prop:test/deepkeys-max-array-index There is no bug in dot-prop. I checked the test by loosening the index check that relies on to : all 77 existing tests still pass, and this test fails. passes (78 tests). The same looser check would also read an array key like as index , so two different keys would get the same path. I'll add a test for that case as soon as the hackathon this came from finishes judging. The test was written with IBM Bob, an AI coding assistant, during that hackathon, and I adapted it to . If you'd like it, I'm happy to open a pull request, or you can take the commit as it is. If not, feel free to close this.
Recent fixes
Summary (both the main package and ) allows method override via / path keys — , , can be replaced with non-function values, causing runtime crashes in consumers. The existing GHSA (GHSA-ff7x-qrg7-qggm) fixed prototype pollution (fixed in 4.2.1 / 5.1.1) but method-name keys were never covered — the issue persists in the latest release (10.2.0). PoC (verified, node v22, dot-prop@10.2.0) Also affects (2.1.1): Real output (node v22) Root cause splits paths on and the set path assigns without filtering method names. The 2020 fix (GHSA-ff7x-qrg7-qggm, commit for #102) only added a // blacklist — , , are still writable as data keys, shadowing inherited methods. Impact Method override (DoS)**: any consumer handling untrusted dot-paths (URL params, config keys, form data, JSON paths) crashes on serialization (, in some paths) or property-existence checks (). Affects the main (≈49M weekly downloads) and (≈40K weekly). Prototype pollution via nested paths may still be possible in edge cases (e.g. chains). Affected versions : all versions, including latest 10.2.0 (and 4.x/5.x despite the GHSA fix — the fix was incomplete) : all versions up to 2.1.1 Suggested fix Extend the existing blacklist (or better, reject any key that is an own property name): Rejecting all inherited own property names (, , , , , , , etc.) is more robust than a hardcoded list.
Repository: sindresorhus/dot-prop. Description: Get, set, or delete a property from a nested object using a dot path Stars: 868, Forks: 122. Primary language: JavaScript. Languages: JavaScript (98%), TypeScript (2%). License: MIT. Latest release: v10.2.0 (3mo ago). Open PRs: 0, open issues: 6. Last activity: 3mo ago. Community health: 85%. Top contributors: sindresorhus, Richienb, stevemao, AuthorProxy, bendrucker, LinusU, SamVerschueren, floatdrop, kphrx, stroncium and others.