Skip to content

Fix DoS via getNthKey #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JeremyMoeglich wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Fix DoS via getNthKey #344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
03b4b84
Improve performance for index lookups on Set, Map
JeremyMoeglich Dec 17, 2025
1d4c9ef
replace tree with array
JeremyMoeglich Dec 18, 2025
e852fcf
introduce regression tests
JeremyMoeglich Feb 9, 2026
113484b
add regression tests from @347
JeremyMoeglich Feb 9, 2026
9eb0fd4
fix regressions
JeremyMoeglich Feb 9, 2026
5cfddf7
add failing test
JeremyMoeglich Feb 12, 2026
cd27b0c
Move logic to transformer
JeremyMoeglich Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions src/accessDeep.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { setDeep } from './accessDeep.js';
import { setDeep, type AccessDeepContext } from './accessDeep.js';

import { describe, it, expect } from 'vitest';

Expand All @@ -7,10 +7,11 @@ describe('setDeep', () => {
const obj = {
a: new Map([[new Set(['NaN']), [[1, 'undefined']]]]),
};
const context: AccessDeepContext = new WeakMap();

setDeep(obj, ['a', 0, 0, 0], Number);
setDeep(obj, ['a', 0, 1], entries => new Map(entries));
setDeep(obj, ['a', 0, 1, 0, 1], () => undefined);
setDeep(obj, ['a', 0, 0, 0], Number, context);
setDeep(obj, ['a', 0, 1], entries => new Map(entries), context);
setDeep(obj, ['a', 0, 1, 0, 1], () => undefined, context);

expect(obj).toEqual({
a: new Map([[new Set([NaN]), new Map([[1, undefined]])]]),
Expand All @@ -21,8 +22,9 @@ describe('setDeep', () => {
const obj = {
a: new Set([10, new Set(['NaN'])]),
};
const context: AccessDeepContext = new WeakMap();

setDeep(obj, ['a', 1, 0], Number);
setDeep(obj, ['a', 1, 0], Number, context);

expect(obj).toEqual({
a: new Set([10, new Set([NaN])]),
Expand Down
93 changes: 70 additions & 23 deletions src/accessDeep.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,33 @@
import { isMap, isArray, isPlainObject, isSet } from './is.js';
import { includes } from './util.js';

const getNthKey = (value: Map<any, any> | Set<any>, n: number): any => {
if (n > value.size) throw new Error('index out of bounds');
const keys = value.keys();
while (n > 0) {
keys.next();
n--;
export type AccessDeepContext = WeakMap<object, any[]>;

const getIndexedKeys = (
value: Map<any, any> | Set<any>,
context: AccessDeepContext
): any[] => {
let indexed = context.get(value);
if (!indexed) {
indexed = Array.from(value.keys());
context.set(value, indexed);
}

return keys.next().value;
return indexed;
};

const getNthKey = (
value: Map<any, any> | Set<any>,
n: number,
context: AccessDeepContext
): any => {
const indexed = getIndexedKeys(value, context);

if (!Number.isInteger(n) || n < 0 || n >= indexed.length) {
throw new Error('index out of bounds');
}

return indexed[n];
};

function validatePath(path: (string | number)[]) {
Expand All @@ -24,18 +42,22 @@ function validatePath(path: (string | number)[]) {
}
}

export const getDeep = (object: object, path: (string | number)[]): object => {
export const getDeep = (
object: object,
path: (string | number)[],
context: AccessDeepContext
): object => {
validatePath(path);

for (let i = 0; i < path.length; i++) {
const key = path[i];
if (isSet(object)) {
object = getNthKey(object, +key);
object = getNthKey(object, +key, context);
} else if (isMap(object)) {
const row = +key;
const type = +path[++i] === 0 ? 'key' : 'value';

const keyOfRow = getNthKey(object, row);
const keyOfRow = getNthKey(object, row, context);
switch (type) {
case 'key':
object = keyOfRow;
Expand All @@ -55,12 +77,13 @@ export const getDeep = (object: object, path: (string | number)[]): object => {
export const setDeep = (
object: any,
path: (string | number)[],
mapper: (v: any) => any
mapper: (v: any, context: AccessDeepContext) => any,
context: AccessDeepContext
): any => {
validatePath(path);

if (path.length === 0) {
return mapper(object);
return mapper(object, context);
}

let parent = object;
Expand All @@ -75,7 +98,7 @@ export const setDeep = (
parent = parent[key];
} else if (isSet(parent)) {
const row = +key;
parent = getNthKey(parent, row);
parent = getNthKey(parent, row, context);
} else if (isMap(parent)) {
const isEnd = i === path.length - 2;
if (isEnd) {
Expand All @@ -85,7 +108,7 @@ export const setDeep = (
const row = +key;
const type = +path[++i] === 0 ? 'key' : 'value';

const keyOfRow = getNthKey(parent, row);
const keyOfRow = getNthKey(parent, row, context);
switch (type) {
case 'key':
parent = keyOfRow;
Expand All @@ -100,38 +123,62 @@ export const setDeep = (
const lastKey = path[path.length - 1];

if (isArray(parent)) {
parent[+lastKey] = mapper(parent[+lastKey]);
const oldValue = parent[+lastKey];
const newValue = mapper(oldValue, context);
parent[+lastKey] = newValue;
} else if (isPlainObject(parent)) {
parent[lastKey] = mapper(parent[lastKey]);
const oldValue = parent[lastKey];
const newValue = mapper(oldValue, context);
parent[lastKey] = newValue;
}

if (isSet(parent)) {
const oldValue = getNthKey(parent, +lastKey);
const newValue = mapper(oldValue);
const row = +lastKey;
const indexed = getIndexedKeys(parent, context);
if (!Number.isInteger(row) || row < 0 || row >= indexed.length) {
throw new Error('index out of bounds');
}
const oldValue = indexed[row];

const newValue = mapper(oldValue, context);

if (oldValue !== newValue) {
parent.delete(oldValue);
if (row < parent.size) {
parent.delete(oldValue);
}
parent.add(newValue);
indexed[row] = newValue;
}
}

if (isMap(parent)) {
const row = +path[path.length - 2];
const keyToRow = getNthKey(parent, row);
const indexed = getIndexedKeys(parent, context);
Copy link
Copy Markdown
Collaborator

@Skn0tt Skn0tt Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i might be missing something - why can't this be getNthKey?

Copy link
Copy Markdown
Author

@JeremyMoeglich JeremyMoeglich Feb 12, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We mutate indexed afterwards, we can replace this with getNthKey but then we would later have to write into context directly

if (!Number.isInteger(row) || row < 0 || row >= indexed.length) {
throw new Error('index out of bounds');
}

const type = +lastKey === 0 ? 'key' : 'value';
const keyToRow = indexed[row];
const isVirtualRow = row >= parent.size;

switch (type) {
case 'key': {
const newKey = mapper(keyToRow);
const newKey = mapper(keyToRow, context);
parent.set(newKey, parent.get(keyToRow));

if (newKey !== keyToRow) {
if (!isVirtualRow && newKey !== keyToRow) {
parent.delete(keyToRow);
}

indexed[row] = newKey;
break;
}

case 'value': {
parent.set(keyToRow, mapper(parent.get(keyToRow)));
const oldValue = parent.get(keyToRow);
const newValue = mapper(oldValue, context);
parent.set(keyToRow, newValue);
break;
}
}
Expand Down
Loading
Loading