fix: obfuscation of an array element can lead to undefined error #312
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
why
In normal circumstances, we should expect that there will be no leaf node in a document that will be
undefined
, since in JSON land, which is the type that we will always serialise, does not have such a primitive. This is the reason why we only handle known JSON primitive types intraverseAndFlatten
, and throw otherwise.The problem comes during
obfuscation
, whentraverseAndFlatten
is used to flatten leaf nodes that are to be removed. We do so by using lodash'spick
on our document, that in cases where there are arrays involved, array items that are not picked, will be left as anundefined/<empty item>
.pick([1,2,3,4], 3)
will result in[undefined, undefined, undefined, 4]
which is passed totraverseAndFlatten
which then throws because now it encounters an unexpected type.what
traverseAndFlatten
to removeundefined
values instead of throwing, it defaults tofalse
true
in obfuscation