fix: isolate walk state from Object prototype

laplace young · fatso83 · commit a76929179340 · 2026-05-05T21:55:24.000+02:00
diff --git a/src/sinon/util/core/walk.js b/src/sinon/util/core/walk.js
@@ -63,7 +63,7 @@ function walkInternal(obj, iterator, context, originalObj, seen) {
  * @returns {void} nothing
  */
 const walk = function (obj, iterator, context) {
-    return walkInternal(obj, iterator, context, obj, {});
+    return walkInternal(obj, iterator, context, obj, Object.create(null));
 };
 
 export default walk;
diff --git a/test/issues/issues-test.js b/test/issues/issues-test.js
@@ -860,4 +860,29 @@ describe("issues", function () {
         assert(cb.calledOnce);
         assert.equals(cb.firstCall.args, ["Hello"]);
     });
+
+    it("#2702 - stub creation should ignore inherited non-writable Object prototype properties", function () {
+        const descriptor = Object.getOwnPropertyDescriptor(
+            Object.prototype,
+            "someFlag",
+        );
+
+        Object.defineProperty(Object.prototype, "someFlag", {
+            value: "x",
+            writable: false,
+            configurable: true,
+        });
+
+        try {
+            refute.exception(function () {
+                sinon.stub();
+            });
+        } finally {
+            if (descriptor) {
+                Object.defineProperty(Object.prototype, "someFlag", descriptor);
+            } else {
+                delete Object.prototype.someFlag;
+            }
+        }
+    });
 });
diff --git a/test/src/util/core/walk-test.js b/test/src/util/core/walk-test.js
@@ -2,6 +2,7 @@ import referee from "@sinonjs/referee";
 import walk from "../../../../src/sinon/util/core/walk.js";
 import createSpy from "../../../../src/sinon/spy.js";
 const assert = referee.assert;
+const refute = referee.refute;
 
 describe("util/core/walk", function () {
     it("should call iterator with value, key, and obj, with context as the receiver", function () {
@@ -163,4 +164,35 @@ describe("util/core/walk", function () {
             assert.equals(index, propertyNames.lastIndexOf(name));
         });
     });
+
+    it("tracks visited names without inheriting Object.prototype properties", function () {
+        const target = {};
+        const iterator = createSpy();
+        const descriptor = Object.getOwnPropertyDescriptor(
+            Object.prototype,
+            "someFlag",
+        );
+
+        // eslint-disable-next-line no-extend-native
+        Object.defineProperty(Object.prototype, "someFlag", {
+            value: "x",
+            writable: false,
+            configurable: true,
+        });
+
+        try {
+            refute.exception(function () {
+                walk(target, iterator);
+            });
+
+            assert(iterator.calledWith("someFlag", Object.prototype));
+        } finally {
+            if (descriptor) {
+                // eslint-disable-next-line no-extend-native
+                Object.defineProperty(Object.prototype, "someFlag", descriptor);
+            } else {
+                delete Object.prototype.someFlag;
+            }
+        }
+    });
 });
