fix: ensure that files/folders whose names are properties of Object.prototype are packaged/extracted correctly

lib/filesystem.js

@@ -14,7 +14,7 @@ const pipeline = promisify(stream.pipeline)
 class Filesystem {
   constructor (src) {
     this.src = path.resolve(src)
-    this.header = { files: {} }
+    this.header = { files: Object.create(null) }
     this.offset = BigInt(0)
   }
 
@@ -24,7 +24,7 @@ class Filesystem {
     for (const dir of dirs) {
       if (dir !== '.') {
         if (!json.files[dir]) {
-          json.files[dir] = { files: {} }
+          json.files[dir] = { files: Object.create(null) }
         }
         json = json.files[dir]
       }
@@ -38,10 +38,10 @@ class Filesystem {
     const name = path.basename(p)
     const node = this.searchNodeFromDirectory(path.dirname(p))
     if (node.files == null) {
-      node.files = {}
+      node.files = Object.create(null)
     }
     if (node.files[name] == null) {
-      node.files[name] = {}
+      node.files[name] = Object.create(null)
     }
     return node.files[name]
   }
@@ -51,7 +51,7 @@ class Filesystem {
     if (shouldUnpack) {
       node.unpacked = shouldUnpack
     }
-    node.files = node.files || {}
+    node.files = node.files || Object.create(null)
     return node.files
   }
 

test/api-spec.js

@@ -94,4 +94,12 @@ describe('api', function () {
     const expected = await fs.readFile('test/input/packthis-unicode-path/dir1/女の子.txt', 'utf8')
     return compFileLists(actual, expected)
   })
+  it('should create files/directories whose names are properties of Object.prototype', async () => {
+    await asar.createPackage('test/input/packthis-object-prototype/', 'tmp/packthis-object-prototype.asar')
+    return compFiles('tmp/packthis-object-prototype.asar', 'test/expected/packthis-object-prototype.asar')
+  })
+  it('should extract files/directories whose names are properties of Object.prototype', () => {
+    asar.extractAll('test/expected/packthis-object-prototype.asar', 'tmp/packthis-object-prototype/')
+    return compDirs('test/input/packthis-object-prototype/', 'tmp/packthis-object-prototype')
+  })
 })

test/input/packthis-object-prototype/__proto__

@@ -0,0 +1 @@
+__proto__

test/input/packthis-object-prototype/constructor/__proto__

@@ -0,0 +1 @@
+constructor/__proto__

test/input/packthis-object-prototype/constructor/constructor

@@ -0,0 +1 @@
+constructor/constructor

test/input/packthis-object-prototype/constructor/file1

@@ -0,0 +1 @@
+constructor/file1

test/input/packthis-object-prototype/file1

@@ -0,0 +1 @@
+file1

test/input/packthis-object-prototype/file2

@@ -0,0 +1 @@
+file2

test/input/packthis-object-prototype/folder1/constructor/constructor/__proto__/__proto__

@@ -0,0 +1 @@
+folder1/constructor/constructor/__proto__/__proto__

test/input/packthis-object-prototype/folder1/constructor/constructor/__proto__/file1

@@ -0,0 +1 @@
+folder1/constructor/constructor/__proto__/file1

test/input/packthis-object-prototype/folder1/constructor/constructor/constructor

@@ -0,0 +1 @@
+folder1/constructor/constructor/constructor

test/input/packthis-object-prototype/folder1/constructor/constructor/file1

@@ -0,0 +1 @@
+folder1/constructor/constructor/file1

test/input/packthis-object-prototype/folder1/file1

@@ -0,0 +1 @@
+folder1/file1