From 9d4b0c3ce6451db0fc94be0a4554fdfdb14326d9 Mon Sep 17 00:00:00 2001
From: Hiroki Osame <hiroki@weebly.com>
Date: Mon, 15 Jan 2018 16:20:13 -0800
Subject: [PATCH 1/2] fix(Injection with Symbol polyfill): hasOwn instead of
'in'
Symbol polyfill adds a setter on the Object prototype so the 'in' check evaluated to true on every
object
fix #7284
---
src/core/instance/inject.js | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/core/instance/inject.js b/src/core/instance/inject.js
index 019026479ec..cb14cfeb05d 100644
--- a/src/core/instance/inject.js
+++ b/src/core/instance/inject.js
@@ -3,6 +3,7 @@
import { warn } from '../util/index'
import { hasSymbol } from 'core/util/env'
import { defineReactive, observerState } from '../observer/index'
+import { hasOwn } from 'shared/util'
export function initProvide (vm: Component) {
const provide = vm.$options.provide
@@ -52,7 +53,7 @@ export function resolveInject (inject: any, vm: Component): ?Object {
const provideKey = inject[key].from
let source = vm
while (source) {
- if (source._provided && provideKey in source._provided) {
+ if (source._provided && hasOwn(source._provided, provideKey)) {
result[key] = source._provided[provideKey]
break
}
From df248f3924fc726eafe96d291b8612397be4e953 Mon Sep 17 00:00:00 2001
From: Hiroki Osame <hiroki@weebly.com>
Date: Mon, 15 Jan 2018 16:45:54 -0800
Subject: [PATCH 2/2] test(Injected properties): Ensures prototype properties
aren't injected
Prototype properties were being injected, so injecting 'constructor' would have hit the first
provide-layer and not yield expected results.
fix #7284
---
test/unit/features/options/inject.spec.js | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/test/unit/features/options/inject.spec.js b/test/unit/features/options/inject.spec.js
index cd5c7097f31..53f55e1ecf2 100644
--- a/test/unit/features/options/inject.spec.js
+++ b/test/unit/features/options/inject.spec.js
@@ -635,4 +635,16 @@ describe('Options provide/inject', () => {
expect(injected).toEqual('foo')
})
+
+ // #7284
+ it('should not inject prototype properties', () => {
+ const vm = new Vue({
+ provide: {}
+ })
+ new Vue({
+ parent: vm,
+ inject: ['constructor']
+ })
+ expect(`Injection "constructor" not found`).toHaveBeenWarned()
+ })
})