Only evaluate own String/Number/Math methods (#16033)

nicolo-ribaudo · web-flow · commit b13376b34694 · 2023-10-11T11:54:14.000-04:00
diff --git a/packages/babel-traverse/src/path/evaluation.ts b/packages/babel-traverse/src/path/evaluation.ts
@@ -444,8 +444,11 @@ function _evaluate(path: NodePath, state: State): any {
         !isInvalidMethod(property.node.name)
       ) {
         context = global[object.node.name];
-        // @ts-expect-error property may not exist in context object
-        func = context[property.node.name];
+        const key = property.node.name;
+        // TODO(Babel 8): Use Object.hasOwn
+        if (Object.hasOwnProperty.call(context, key)) {
+          func = context[key as keyof typeof context];
+        }
       }
 
       // "abc".charCodeAt(4)
diff --git a/packages/babel-traverse/test/evaluation.js b/packages/babel-traverse/test/evaluation.js
@@ -152,6 +152,12 @@ describe("evaluation", function () {
     expect(eval_invalid_call.confident).toBe(false);
   });
 
+  it("should not evaluate inherited methods", function () {
+    const path = getPath("Math.hasOwnProperty('min')");
+    const evalResult = path.get("body.0.expression").evaluate();
+    expect(evalResult.confident).toBe(false);
+  });
+
   it("should evaluate global call expressions", function () {
     expect(
       getPath("isFinite(1);").get("body.0.expression").evaluate().value,
