Enhance prototype pollution protection

[zjs81]

Added constructor and prototype to the not allowed keys

[zjs81]

This fixes a potental security issue.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.36%. Comparing base (69295b3) to head (72c8490).
⚠️ Report is 39 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #288   +/-   ##
=======================================
  Coverage   97.36%   97.36%           
=======================================
  Files          16       16           
  Lines        1138     1138           
  Branches      252      252           
=======================================
  Hits         1108     1108           
  Misses         30       30           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gfx]

Thanks. Will release a new version immediatly.

[zjs81]

Awesome thank you for your attention on this.

[michaelficarra]

A better fix would be to just make state.map a null-prototype object in

msgpack-javascript/src/Decoder.ts

Line 138 in dd2190b

state.map = {};

state.map = { __proto__: null };

Then you don't have to reject any key names.

[michaelficarra]

This is the same thing as

Suggested change

	const o = {
	foo: "bar",
	};
	// override constructor as an enumerable property
	Object.defineProperty(o, "constructor", {
	value: new Date(0),
	enumerable: true,
	});
	const o = {
	foo: "bar",
	constructor: new Date(0),
	};

[michaelficarra]

Instead of just testing that it fails to decode, you should've instead tested that, even in the hostile environment where you've imagined a current security issue, the library does not trigger it.

[michaelficarra]

Alternatively, on

msgpack-javascript/src/Decoder.ts

Line 664 in dd2190b

state.map[state.key!] = object;

you can just use Object.defineProperty instead of assignment. Either way, there's no need to forbid any key names.