refactor: use SafeMap rather than plain object hash for internal results

pkgjs / parseargs

Polyfill of `util.parseArgs()`

Apache License 2.0

121 stars 9 forks source link

refactor: use SafeMap rather than plain object hash for internal results #65

Closed shadowspawn closed 2 years ago

shadowspawn commented 2 years ago

This came out of discussion around potential for prototype pollution. Use a Map rather than Object internally. Convert to Object for returning to client.

See https://github.com/pkgjs/parseargs/issues/32#issuecomment-1013948553

Take two, previous draft in #57

ToDo: add some related tests from https://github.com/pkgjs/parseargs/pull/57#pullrequestreview-873939685

shadowspawn commented 2 years ago

I am getting pretty used to the primordial routines now, and this got broken by other PR again. Adding some prototype pollution tests is probably still a good idea independent of SafeMap. I won't keep this open as a placeholder for further action though.