In @src/__tests__/ObjectStateMutations-test.js:
- Around line 499-500: The test is passing ParseOps.SetOp objects where
commitServerChanges expects plain attribute values; find the failing data object
in the test (the entry using __proto__: new ParseOps.SetOp({ polluted: 'yes' })
and constructor: new ParseOps.SetOp({ malicious: 'data' })) and replace those
ParseOps.SetOp wrappers with the raw values/objects (e.g., __proto__: {
polluted: 'yes' } or simply polluted: 'yes', and constructor: 'malicious data'
or the plain value you intend) so the payload matches other uses of
commitServerChanges (like the plain { name: 'foo', data: { count: 5 } }
examples).
- Around line 474-490: Update the test to match the actual function being called
and supply the missing third argument: change the description from
"mergeFirstPendingState" to "setPendingOp", and call
ObjectStateMutations.setPendingOp(pendingOps, '__proto__',
pendingOps[0]['__proto__']) (using the third arg from the pendingOps element) so
the function signature (pendingOps, key, op) is satisfied and the test still
verifies Object.prototype is not polluted.
- Around line 438-454: The test is passing ParseOps.SetOp objects to
ObjectStateMutations.setServerData but that function expects plain values;
update the test's attributes to use plain values (e.g., __proto__: { polluted:
'yes' } and constructor: { malicious: 'data' }) before calling
ObjectStateMutations.setServerData(serverData, attributes) so the behavior
matches other tests and the prototype pollution assertions remain valid.