fix(config): restrict config paths to own properties

zenglingbiao · vincentkoc · commit e526054a6c31 · 2026-07-03T23:22:54.000-07:00
diff --git a/src/config/config-paths.test.ts b/src/config/config-paths.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import {
+  getConfigValueAtPath,
+  setConfigValueAtPath,
+  unsetConfigValueAtPath,
+} from "./config-paths.js";
+
+describe("config path own-property traversal", () => {
+  for (const key of ["toString", "valueOf", "hasOwnProperty"]) {
+    it(`does not treat inherited ${key} as config`, () => {
+      const parent: Record<string, unknown> = {};
+      const root: Record<string, unknown> = { parent };
+
+      expect(getConfigValueAtPath(root, ["parent", key])).toBeUndefined();
+      expect(unsetConfigValueAtPath(root, ["parent", key])).toBe(false);
+      expect(root).toEqual({ parent: {} });
+
+      setConfigValueAtPath(root, ["parent", key], "own");
+      expect(Object.hasOwn(parent, key)).toBe(true);
+      expect(getConfigValueAtPath(root, ["parent", key])).toBe("own");
+      expect(unsetConfigValueAtPath(root, ["parent", key])).toBe(true);
+      expect(root).toEqual({});
+    });
+  }
+
+  it("replaces an inherited parent instead of traversing it", () => {
+    const prototypeBranch = { leaf: "prototype" };
+    const root = Object.create({ branch: prototypeBranch }) as Record<string, unknown>;
+
+    expect(getConfigValueAtPath(root, ["branch", "leaf"])).toBeUndefined();
+    expect(unsetConfigValueAtPath(root, ["branch", "leaf"])).toBe(false);
+    expect(prototypeBranch).toEqual({ leaf: "prototype" });
+
+    setConfigValueAtPath(root, ["branch", "leaf"], "own");
+    expect(Object.hasOwn(root, "branch")).toBe(true);
+    expect(root.branch).toEqual({ leaf: "own" });
+    expect(prototypeBranch).toEqual({ leaf: "prototype" });
+
+    expect(unsetConfigValueAtPath(root, ["branch", "leaf"])).toBe(true);
+    expect(Object.hasOwn(root, "branch")).toBe(false);
+    expect(getConfigValueAtPath(root, ["branch", "leaf"])).toBeUndefined();
+    expect(prototypeBranch).toEqual({ leaf: "prototype" });
+  });
+});
diff --git a/src/config/config-paths.ts b/src/config/config-paths.ts
@@ -1,6 +1,6 @@
+import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 // Resolves and classifies config paths for reads, writes, and metadata.
 import { isPlainObject } from "../utils.js";
-import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 
 type PathNode = Record<string, unknown>;
 
@@ -37,11 +37,12 @@ export function setConfigValueAtPath(root: PathNode, path: string[], value: unkn
   let cursor: PathNode = root;
   for (let idx = 0; idx < path.length - 1; idx += 1) {
     const key = path[idx];
-    const next = cursor[key];
-    if (!isPlainObject(next)) {
-      cursor[key] = {};
+    const existing = Object.hasOwn(cursor, key) ? cursor[key] : undefined;
+    const next: PathNode = isPlainObject(existing) ? existing : {};
+    if (next !== existing) {
+      cursor[key] = next;
     }
-    cursor = cursor[key] as PathNode;
+    cursor = next;
   }
   cursor[path[path.length - 1]] = value;
 }
@@ -52,6 +53,9 @@ export function unsetConfigValueAtPath(root: PathNode, path: string[]): boolean
   let cursor: PathNode = root;
   for (let idx = 0; idx < path.length - 1; idx += 1) {
     const key = path[idx];
+    if (!Object.hasOwn(cursor, key)) {
+      return false;
+    }
     const next = cursor[key];
     if (!isPlainObject(next)) {
       return false;
@@ -60,7 +64,7 @@ export function unsetConfigValueAtPath(root: PathNode, path: string[]): boolean
     cursor = next;
   }
   const leafKey = path[path.length - 1];
-  if (!(leafKey in cursor)) {
+  if (!Object.hasOwn(cursor, leafKey)) {
     return false;
   }
   delete cursor[leafKey];
@@ -82,7 +86,7 @@ export function unsetConfigValueAtPath(root: PathNode, path: string[]): boolean
 export function getConfigValueAtPath(root: PathNode, path: string[]): unknown {
   let cursor: unknown = root;
   for (const key of path) {
-    if (!isPlainObject(cursor)) {
+    if (!isPlainObject(cursor) || !Object.hasOwn(cursor, key)) {
       return undefined;
     }
     cursor = cursor[key];
