use only alias field properties

prevent checking object prototype properties
webpack · Apr 4, 2022 · b16c35c · b16c35c
1 parent c960801
commit b16c35c
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 3 deletions.
diff --git a/lib/AliasFieldPlugin.js b/lib/AliasFieldPlugin.js
@@ -49,9 +49,17 @@ module.exports = class AliasFieldPlugin {
 						);
 					return callback();
 				}
-				const data1 = fieldData[innerRequest];
-				const data2 = fieldData[innerRequest.replace(/^\.\//, "")];
-				const data = typeof data1 !== "undefined" ? data1 : data2;
+				const data = Object.prototype.hasOwnProperty.call(
+					fieldData,
+					innerRequest
+				)
+					? fieldData[innerRequest]
+					: Object.prototype.hasOwnProperty.call(
+							fieldData,
+							innerRequest.replace(/^\.\//, "")
+					  )
+					? fieldData[innerRequest.slice(2)]
+					: undefined;
 				if (data === innerRequest) return callback();
 				if (data === undefined) return callback();
 				if (data === false) {

diff --git a/test/browserField.js b/test/browserField.js
@@ -84,4 +84,10 @@ describe("browserField", function () {
 			.resolveSync({}, p(), "./lib/main2.js")
 			.should.be.eql(p("lib", "browser.js"));
 	});
+
+	it("should check only alias field properties", () => {
+		resolver
+			.resolveSync({}, p(), "./toString")
+			.should.be.eql(p("lib", "toString.js"));
+	});
 });
diff --git a/test/fixtures/browser-module/lib/toString.js b/test/fixtures/browser-module/lib/toString.js
diff --git a/test/fixtures/browser-module/package.json b/test/fixtures/browser-module/package.json
@@ -4,6 +4,7 @@
     "./lib/replaced.js": "./lib/browser",
     "module-a": "./browser/module-a.js",
     "module-b": "module-c",
+    "./toString": "./lib/toString.js",
     ".": false
   },
   "innerBrowser1": {