ElemeFE / ElemeFE/element

getPropByPath是不是存在漏洞?

Open
#20,371 1 comment 1 reaction 0 assignees View on GitHub
stale
Dominant language
Vue
Stars
54k
Forks
14.4k
PR merge metrics
No merged PRs in 30d

Description

`
export function getPropByPath(obj, path, strict) {
let tempObj = obj;
path = path.replace(/\[(\w+)\]/g, '.$1');
path = path.replace(/^\./, '');

let keyArr = path.split('.');
let i = 0;
for (let len = keyArr.length; i < len - 1; ++i) {
if (!tempObj && !strict) break;
let key = keyArr[i];
**if (key in tempObj)** {
tempObj = tempObj[key];
} else {
if (strict) {
throw new Error('please transfer a valid prop path to form item!');
}
break;
}
}
return {
o: tempObj,
k: keyArr[i],
v: tempObj ? tempObj[keyArr[i]] : null
};
};
`
key in tempObj 这里是不是要先判断下tempObj是不是对象。如果不是抛出和下面一样的异常?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the getPropByPath function shown in the issue and reproduce a property path whose intermediate value is not an object. Check the behavior of the `key in tempObj` expression and compare it with the existing strict-mode error; done means the invalid path has a defined, consistent outcome and a regression test covers it.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.