Skip to content

Commit 6022567

Browse files
committed
Use setprototypeof module to replace __proto__ setting
closes #1967 closes #2613 closes #3103 closes #3164
1 parent 12ff56e commit 6022567

File tree

5 files changed

+20
-9
lines changed

5 files changed

+20
-9
lines changed

History.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ unreleased
66
- Improves compatibility with Node.js 8 nightly
77
* Skip routing when `req.url` is not set
88
* Use `Object.create` to setup request & response prototypes
9+
* Use `setprototypeof` module to replace `__proto__` setting
910
* Use `statuses` instead of `http` module for status messages
1011
1112
- Allow colors in workers

lib/application.js

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ var deprecate = require('depd')('express');
2828
var flatten = require('array-flatten');
2929
var merge = require('utils-merge');
3030
var resolve = require('path').resolve;
31+
var setPrototyeOf = require('setprototypeof')
3132
var slice = Array.prototype.slice;
3233

3334
/**
@@ -94,10 +95,10 @@ app.defaultConfiguration = function defaultConfiguration() {
9495
}
9596

9697
// inherit protos
97-
this.request.__proto__ = parent.request;
98-
this.response.__proto__ = parent.response;
99-
this.engines.__proto__ = parent.engines;
100-
this.settings.__proto__ = parent.settings;
98+
setPrototyeOf(this.request, parent.request)
99+
setPrototyeOf(this.response, parent.response)
100+
setPrototyeOf(this.engines, parent.engines)
101+
setPrototyeOf(this.settings, parent.settings)
101102
});
102103

103104
// setup locals
@@ -227,8 +228,8 @@ app.use = function use(fn) {
227228
router.use(path, function mounted_app(req, res, next) {
228229
var orig = req.app;
229230
fn.handle(req, res, function (err) {
230-
req.__proto__ = orig.request;
231-
res.__proto__ = orig.response;
231+
setPrototyeOf(req, orig.request)
232+
setPrototyeOf(res, orig.response)
232233
next(err);
233234
});
234235
});

lib/middleware/init.js

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@
88

99
'use strict';
1010

11+
/**
12+
* Module dependencies.
13+
* @private
14+
*/
15+
16+
var setPrototyeOf = require('setprototypeof')
17+
1118
/**
1219
* Initialization middleware, exposing the
1320
* request and response to each other, as well
@@ -25,8 +32,8 @@ exports.init = function(app){
2532
res.req = req;
2633
req.next = next;
2734

28-
req.__proto__ = app.request;
29-
res.__proto__ = app.response;
35+
setPrototyeOf(req, app.request)
36+
setPrototyeOf(res, app.response)
3037

3138
res.locals = res.locals || Object.create(null);
3239

lib/router/index.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ var debug = require('debug')('express:router');
2121
var deprecate = require('depd')('express');
2222
var flatten = require('array-flatten');
2323
var parseUrl = require('parseurl');
24+
var setPrototypeOf = require('setprototypeof')
2425

2526
/**
2627
* Module variables.
@@ -47,7 +48,7 @@ var proto = module.exports = function(options) {
4748
}
4849

4950
// mixin Router class functions
50-
router.__proto__ = proto;
51+
setPrototypeOf(router, proto)
5152

5253
router.params = {};
5354
router._params = [];

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
"range-parser": "~1.2.0",
5151
"send": "0.14.2",
5252
"serve-static": "~1.11.2",
53+
"setprototypeof": "1.0.3",
5354
"statuses": "~1.3.1",
5455
"type-is": "~1.6.14",
5556
"utils-merge": "1.0.0",

0 commit comments

Comments
 (0)