fix(react-intl): fix crash when message id is __proto__, fix #1885

formatjs · Jul 29, 2020 · a42cdec · a42cdec
1 parent 0a08310
commit a42cdec
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/packages/react-intl/src/formatters/message.ts b/packages/react-intl/src/formatters/message.ts
@@ -150,11 +150,15 @@ export function formatMessage(
     | FormatXMLElementFn<React.ReactNode, React.ReactNode>
   >
 ): React.ReactNode {
-  const {id, defaultMessage} = messageDescriptor;
+  const {id: msgId, defaultMessage} = messageDescriptor;
 
   // `id` is a required field of a Message Descriptor.
-  invariant(!!id, '[React Intl] An `id` must be provided to format a message.');
-  const message = messages && messages[String(id)];
+  invariant(
+    !!msgId,
+    '[React Intl] An `id` must be provided to format a message.'
+  );
+  const id = String(msgId);
+  const message = messages && messages.hasOwnProperty(id) && messages[id];
 
   // IMPORTANT: Hot path if `message` is AST with a single literal node
   if (

diff --git a/packages/react-intl/tests/unit/format.tsx b/packages/react-intl/tests/unit/format.tsx
@@ -732,6 +732,11 @@ describe('format API', () => {
       expect(formatMessage({id: 'no_args'})).toBe(mf.format());
     });
 
+    it('formats message with ID as a method in Object.prototype, GH issue #1885', () => {
+      expect(formatMessage({id: 'toString'})).toBe('toString');
+      expect(formatMessage({id: '__proto__'})).toBe('__proto__');
+    });
+
     it('formats legacy HTML messages', () => {
       const {locale, messages} = config;
       const mf = new IntlMessageFormat(messages.richText, locale);