From 22057ef61c6efb485b2374afe0fe3a3b2ecbc249 Mon Sep 17 00:00:00 2001 From: Andrew Zich Date: Tue, 18 Mar 2014 14:55:08 -0700 Subject: [PATCH] don't try to use Object.prototype methods as transfer strategies in ReactPropTransferer.mergeProps While looking up a detail of how `transferPropsTo()` works I noticed that we never check `TransferStrategies.hasOwnProperty(thisKey)` when merging props, just `newProps.hasOwnProperty(thisKey)` and a truthy test for `TransferStrategies[thisKey]`. This means that if our `newProps` has keys like `toString`, `valueOf`, or `constructor` etc. set, we will pull these functions off `TransferStrategies` and invoke them when merging props. In most cases this will just result in a failure to merge and some code without side effects being run but in the case of `valueOf` it will actually generate an exception. --- src/core/ReactPropTransferer.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/ReactPropTransferer.js b/src/core/ReactPropTransferer.js index 8761f0ef4c..2915c76f23 100644 --- a/src/core/ReactPropTransferer.js +++ b/src/core/ReactPropTransferer.js @@ -95,7 +95,7 @@ var ReactPropTransferer = { var transferStrategy = TransferStrategies[thisKey]; - if (transferStrategy) { + if (transferStrategy && TransferStrategies.hasOwnProperty(thisKey)) { transferStrategy(props, thisKey, newProps[thisKey]); } else if (!props.hasOwnProperty(thisKey)) { props[thisKey] = newProps[thisKey];