René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][i18n] interpolate/ICU resolve inherited Object.prototype names via 'in' operator (contract violation)","articleBody":"## Severity: 🟢 Low (correctness + minor info-shape leak)\n\n## Location\n[`src/i18n/translate.ts:49-54`](../blob/main/src/i18n/translate.ts#L49-L54) (`interpolate` — `if (key in params)`); [`src/i18n/icu.ts:280`](../blob/main/src/i18n/icu.ts#L280) (`arg` node) and `:284` (`select` node).\n\n## Description\nPlaceholder resolution uses the `in` operator, which walks the prototype chain, then `String(params[key])`. A placeholder whose name matches an `Object.prototype` member (`toString`, `valueOf`, `constructor`, `hasOwnProperty`, `__proto__`, …) is treated as \"present\" even when `params` is `{}`, and is substituted with the inherited value instead of being left as the literal `{name}`.\n\n```ts\ninterpolate('Hello {toString}', {});\n// =\u003e 'Hello function toString() { [native code] }'\n// expected (documented contract): 'Hello {toString}'\n```\nSame for `formatMessage('{x, select, other {{toString}}}', {})`. Impact is limited (`params` is app-supplied and the placeholder must collide with a prototype member), so it is primarily a **contract violation** of \"unmatched placeholders are left intact\", with a minor info-shape leak (native function source) when a translation catalog is attacker/translator-controlled and the param is absent. Not a pollution or code-execution vector.\n\n## Suggested fix\nUse an own-property check consistently at all three sites:\n```ts\nif (Object.prototype.hasOwnProperty.call(params, key)) { … }\n```\nConsider the same guard defensively in `resolveKey` (`translate.ts:20-31`), which currently traverses key segments without a prototype check (mitigated today only because messages are built with `Object.create(null)`).\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/174/bQuery/issues/174"}