Safe object access

Prototype-pollution-safe own-property access. Interpolators, template engines, and structured readers that look up a key by name on an attacker-influenced object must treat an inherited / prototype-chain key (__proto__, constructor, toString) as ABSENT — never read it into rendered output. This composes that guard into one primitive so every consumer routes through the same hardened read instead of hand-rolling Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined (which a __proto__ accessor property can still defeat).

b.safeObject.ownProp(obj, key) #

Returns the value of obj's OWN property key, or undefined when key is not an own property (inherited / prototype-chain keys read as absent). Uses Object.getOwnPropertyDescriptor rather than hasOwnProperty + index read, so a __proto__-injected accessor property cannot run on read. A defined-but-undefined own value returns undefined (callers treat that as absent, matching the prior guarded reads).

b.safeObject.ownProp({ a: 1 }, "a");          // → 1
b.safeObject.ownProp({}, "toString");         // → undefined  (inherited)
b.safeObject.ownProp({}, "__proto__");        // → undefined

b.safeObject.ownSet(obj, key, value) #

Sets obj[key] = value as a plain own data property via Object.defineProperty, so a __proto__ / constructor / accessor key on the prototype chain cannot intercept the write or pollute the prototype. Returns obj.

var o = {};
b.safeObject.ownSet(o, "__proto__", { polluted: 1 });
({}).polluted;   // → undefined  (Object.prototype not touched)

Last updated 2026-08-08T16:39:49.652Z by seeder.