comunica / traqula / 27267384165

100%

push

github

Fix: reserved key (#147)

* fix: use Object.hasOwn to prevent reserved-key bypass in prefix validation

Using plain object bracket access for prefix lookups allowed prototype-chain
keys (constructor, toString, __proto__, etc.) to bypass the "Unknown prefix"
guard, since they resolve to inherited values rather than undefined.

Instead of patching every lookup with Object.hasOwn, fix the root cause by
creating all internal lookup maps with null prototypes so there are no
inherited properties to collide with.

Creation sites updated (prefixes, VALUES mappings, graph-grouping, rule maps):
- packages/rules-sparql-1-1/lib/MinimalSparqlParser.ts
- packages/rules-sparql-1-2/lib/parserUtils.ts
- engines/parser-sparql-1-2/lib/Parser.ts
- packages/algebra-transformations-1-1/lib/toAlgebra/core.ts
- packages/rules-sparql-1-1/lib/grammar/whereClause.ts
- packages/algebra-transformations-1-1/lib/toAst/updateUnit.ts
- packages/core/lib/parser-builder/parserBuilder.ts
- packages/core/lib/indirection-builder/helpers.ts
- packages/core/lib/indirection-builder/IndirBuilder.ts
- packages/core/lib/generator-builder/generatorBuilder.ts

* test: add regression tests for prototype-key prefix bypass

Tests that fail on main (before the fix) and pass on this branch:

Parser (engines/parser-sparql-1-1/test/extraCoverage.test.ts):
- Prefixes named 'constructor', 'toString', 'hasOwnProperty', 'valueOf'
  must be rejected with 'Unknown prefix' when undeclared. On main these
  slip through because `{}`['constructor'] resolves via the prototype
  chain and is not `undefined`.
- A declared prefix with a prototype-key name must be accepted (positive case).

Algebra (engines/algebra-sparql-1-1/test/extraCoverage.test.ts):
- toAlgebra must throw 'Unknown prefix: constructor' when the prefix is
  undeclared, not silently produce a garbage IRI by coercing the Object
  constructor function to a string.
- A prototype-key prefix declared in the query string expands correctly.
- A prototype-k... (continued)

758 of 758 branches covered (100.0%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 6 files covered. (100.0%)

5467 of 5467 relevant lines covered (100.0%)

283134.0 hits per line