fix(localize): build runtime translations map with a null prototype#69705
Open
arshsmith1 wants to merge 1 commit into
Open
fix(localize): build runtime translations map with a null prototype#69705arshsmith1 wants to merge 1 commit into
arshsmith1 wants to merge 1 commit into
Conversation
loadTranslations stores parsed translations into the shared global $localize.TRANSLATIONS keyed by message id. Those ids come verbatim from the translations map (typically parsed from a translation file), so a translation whose id is __proto__ assigns through the inherited __proto__ setter, reparenting the map rather than storing the entry (and throwing under --disable-proto=throw). Create the map with Object.create(null) in loadTranslations and clearTranslations so __proto__ is an ordinary key.
alan-agius4
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
PR Type
What is the current behavior?
Issue Number: N/A
loadTranslationsbuilds the shared global$localize.TRANSLATIONSas a plain{}and then indexes it with message ids taken verbatim from thetranslationsmap, which is commonly parsed from a translation file. A translation whose id is__proto__therefore assigns aParsedTranslationthrough the inherited__proto__setter, which reparents the map instead of storing the entry: the__proto__translation is silently dropped, a later lookup for an id such astextresolves to the injected value through the prototype, and undernode --disable-proto=throwthe assignment throws.What is the new behavior?
The translations store is created with
Object.create(null)in bothloadTranslationsandclearTranslations, so a__proto__message id is treated as an ordinary key. This mirrors the null-prototype hardening already used for outlet maps in the router url parser. Added a regression test that loads a__proto__id alongside a normal one and checks the map is not reparented and the normal translation still resolves.Does this PR introduce a breaking change?
Other information