fix(runtime-core): avoid accidental access of Object.prototype properties

diff --git a/packages/runtime-core/src/componentOptions.ts b/packages/runtime-core/src/componentOptions.ts
index ee92ef521d0af2694f5ba6e6fb7becefa0a0e88e..083a2c0d0f7434f1614de38e15fea72fd3ecf6e7 100644 (file)
--- a/packages/runtime-core/src/componentOptions.ts
+++ b/packages/runtime-core/src/componentOptions.ts
@@ -723,9 +723,8 @@ export function resolveMergedOptions(
 function mergeOptions(to: any, from: any, instance: ComponentInternalInstance) {
   const strats = instance.appContext.config.optionMergeStrategies
   for (const key in from) {
-    const strat = strats && strats[key]
-    if (strat) {
-      to[key] = strat(to[key], from[key], instance.proxy, key)
+    if (strats && hasOwn(strats, key)) {
+      to[key] = strats[key](to[key], from[key], instance.proxy, key)
     } else if (!hasOwn(to, key)) {
       to[key] = from[key]
     }

diff --git a/packages/runtime-core/src/componentProxy.ts b/packages/runtime-core/src/componentProxy.ts
index 400e552158390de098de82535a0caf1a4aec6844..5e3d5d1ac85e838b0c9ac762652a3126df887e70 100644 (file)
--- a/packages/runtime-core/src/componentProxy.ts
+++ b/packages/runtime-core/src/componentProxy.ts
@@ -166,10 +166,9 @@ export type ComponentPublicInstanceConstructor<
   new (): T
 }
 
-const publicPropertiesMap: Record<
-  string,
-  (i: ComponentInternalInstance) => any
-> = {
+type PublicPropertiesMap = Record<string, (i: ComponentInternalInstance) => any>
+
+const publicPropertiesMap: PublicPropertiesMap = extend(Object.create(null), {
   $: i => i,
   $el: i => i.vnode.el,
   $data: i => i.data,
@@ -184,7 +183,7 @@ const publicPropertiesMap: Record<
   $forceUpdate: i => () => queueJob(i.update),
   $nextTick: () => nextTick,
   $watch: __FEATURE_OPTIONS__ ? i => instanceWatch.bind(i) : NOOP
-}
+} as PublicPropertiesMap)
 
 const enum AccessTypes {
   SETUP,