src/content/docs/linter/rules/no-prototype-builtins.mdx
import { Tabs, TabItem } from '@astrojs/starlight/components';
<Tabs> <TabItem label="JavaScript (and super languages)" icon="seti:javascript"> ## Summary - Rule available since: `v1.1.0` - Diagnostic Category: [`lint/suspicious/noPrototypeBuiltins`](/reference/diagnostics#diagnostic-category) - This rule is **recommended**, meaning it is enabled by default. - This rule has a [**safe**](/linter/#safe-fixes) fix. - The default severity of this rule is [**warning**](/reference/diagnostics#warning). - Sources: - Same as [`no-prototype-builtins`](https://eslint.org/docs/latest/rules/no-prototype-builtins) - Same as [`prefer-object-has-own`](https://eslint.org/docs/latest/rules/prefer-object-has-own) - Same as [`e18e/prefer-object-has-own`](https://github.com/e18e/eslint-plugin){
"linter": {
"rules": {
"suspicious": {
"noPrototypeBuiltins": "error"
}
}
}
}
Disallow direct use of Object.prototype builtins.
ECMAScript 5.1 added Object.create which allows the creation of an object with a custom prototype.
This pattern is often used for objects used as Maps. However, this pattern can lead to errors
if something else relies on prototype properties/methods.
Moreover, the methods could be shadowed, this can lead to random bugs and denial of service
vulnerabilities. For example, calling hasOwnProperty directly on parsed JSON like {"hasOwnProperty": 1} could lead to vulnerabilities.
To avoid subtle bugs like this, you should call these methods from Object.prototype.
For example, foo.isPrototypeOf(bar) should be replaced with Object.prototype.isPrototypeOf.call(foo, "bar")
As for the hasOwn method, foo.hasOwn("bar") should be replaced with Object.hasOwn(foo, "bar").
var invalid = foo.hasOwnProperty("bar");
var invalid = foo.isPrototypeOf(bar);
var invalid = foo.propertyIsEnumerable("bar");
Object.hasOwnProperty.call(foo, "bar");
var valid = Object.hasOwn(foo, "bar");
var valid = Object.prototype.isPrototypeOf.call(foo, bar);
var valid = {}.propertyIsEnumerable.call(foo, "bar");