@samitouri / QOS-React-2 / commits / 22057ef61c

don't try to use Object.prototype methods as transfer strategies in ReactPropTransferer.mergeProps

While looking up a detail of how `transferPropsTo()` works I noticed that we never check `TransferStrategies.hasOwnProperty(thisKey)` when merging props, just `newProps.hasOwnProperty(thisKey)` and a truthy test for `TransferStrategies[thisKey]`. This means that if our `newProps` has keys like `toString`, `valueOf`, or `constructor` etc. set, we will pull these functions off `TransferStrategies` and invoke them when merging props. In most cases this will just result in a failure to merge and some code without side effects being run but in the case of `valueOf` it will actually generate an exception.

Andrew Zich committed Mar 18, 2014 at 14:55 UTC 22057ef61c6efb485b2374afe0fe3a3b2ecbc249
1 file changed +1 -1
src/core/ReactPropTransferer.js
+1 -1
@@ -95,7 +95,7 @@ var ReactPropTransferer = {
95
96 var transferStrategy = TransferStrategies[thisKey];
97
98 - if (transferStrategy) {
98 + if (transferStrategy && TransferStrategies.hasOwnProperty(thisKey)) {
99 transferStrategy(props, thisKey, newProps[thisKey]);
100 } else if (!props.hasOwnProperty(thisKey)) {
101 props[thisKey] = newProps[thisKey];