dot-prop
Get, set, or delete a property from a nested object using a dot path
by sindresorhusJavaScript
Commit activity
Last 12 weeks · 2 commits
Community health
4 of 6 standards met
85
✓README✓License✓Contributing✓Code of Conduct○Issue Template○PR Template
Recent PRs & issues
Active · 4 discussions · Last activity 1mo ago
See all on GitHub →
Is there a way to make it so can merge, rather than replace?
When accessing a object using with an empty array, it currently returns the fallback value. This came to me as a surprise, isn't an empty string a zero nested path to the root object? https://github.com/sindresorhus/dot-prop/blob/8e81843270e42051ea8fda6035de1d638856fad5/index.js#L274-L277 Changing this would probably be a breaking change, but I think it would be more consistent.
Recent fixes
Summary (both the main package and ) allows method override via / path keys — , , can be replaced with non-function values, causing runtime crashes in consumers. The existing GHSA (GHSA-ff7x-qrg7-qggm) fixed prototype pollution (fixed in 4.2.1 / 5.1.1) but method-name keys were never covered — the issue persists in the latest release (10.2.0). PoC (verified, node v22, dot-prop@10.2.0) Also affects (2.1.1): Real output (node v22) Root cause splits paths on and the set path assigns without filtering method names. The 2020 fix (GHSA-ff7x-qrg7-qggm, commit for #102) only added a // blacklist — , , are still writable as data keys, shadowing inherited methods. Impact Method override (DoS)**: any consumer handling untrusted dot-paths (URL params, config keys, form data, JSON paths) crashes on serialization (, in some paths) or property-existence checks (). Affects the main (≈49M weekly downloads) and (≈40K weekly). Prototype pollution via nested paths may still be possible in edge cases (e.g. chains). Affected versions : all versions, including latest 10.2.0 (and 4.x/5.x despite the GHSA fix — the fix was incomplete) : all versions up to 2.1.1 Suggested fix Extend the existing blacklist (or better, reject any key that is an own property name): Rejecting all inherited own property names (, , , , , , , etc.) is more robust than a hardcoded list.
Structured data for AI agents
Repository: sindresorhus/dot-prop. Description: Get, set, or delete a property from a nested object using a dot path Stars: 868, Forks: 120. Primary language: JavaScript. Languages: JavaScript (98%), TypeScript (2%). License: MIT. Latest release: v10.2.0 (1mo ago). Open PRs: 0, open issues: 4. Last activity: 1mo ago. Community health: 85%. Top contributors: sindresorhus, Richienb, stevemao, AuthorProxy, bendrucker, LinusU, SamVerschueren, floatdrop, kphrx, stroncium and others.