Fix possible prototype pollution

Not entirely sure how likely this will ever be for metadata, but just in case that the entire metadata record's prototype is attempted polluted, then this will prevent it.
aedart · Apr 28, 2023 · c3e2ee0 · c3e2ee0
1 parent 300421f
commit c3e2ee0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/support/src/meta/meta.ts b/packages/support/src/meta/meta.ts
@@ -217,7 +217,7 @@ function resolveMetadataRecord(owner: object, context: Context, useMetaFromConte
     }
 
     // Obtain record from registry, or create new empty object.
-    let metadata: MetadataRecord = registry.get(owner) ?? {};
+    let metadata: MetadataRecord = registry.get(owner) ?? Object.create(null);
 
     // In case that the owner has Symbol.metadata defined (e.g. from base class),
     // then merge it current metadata. This ensures that inheritance works as