Skip to content

fix: use Object.hasOwn for action name lookup#15721

Merged
matthewp merged 1 commit into
mainfrom
action-prototype-traversal
Mar 2, 2026
Merged

fix: use Object.hasOwn for action name lookup#15721
matthewp merged 1 commit into
mainfrom
action-prototype-traversal

Conversation

@matthewp

@matthewp matthewp commented Mar 2, 2026

Copy link
Copy Markdown
Contributor

Changes

  • Use Object.hasOwn() instead of in operator when resolving action names in getAction(), so prototype methods like constructor or toString are not treated as valid actions.

Testing

  • Added tests in both dev and build that POST to /_actions/constructor, /_actions/__proto__, /_actions/toString, and /_actions/valueOf and assert 404.

Docs

N/A, bug fix

@changeset-bot

changeset-bot Bot commented Mar 2, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 1a8fe7b

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions Bot added the pkg: astro Related to the core `astro` package (scope) label Mar 2, 2026
@codspeed-hq

codspeed-hq Bot commented Mar 2, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 18 untouched benchmarks


Comparing action-prototype-traversal (1a8fe7b) with main (4000aaa)

Open in CodSpeed

@matthewp
matthewp marked this pull request as ready for review March 2, 2026 18:50
@matthewp
matthewp merged commit e6e146c into main Mar 2, 2026
26 checks passed
@matthewp
matthewp deleted the action-prototype-traversal branch March 2, 2026 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants