Only evaluate own String/Number/Math methods (#16033)

babel · Oct 11, 2023 · b13376b · b13376b
1 parent aa65ac2
commit b13376b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 2 deletions.
diff --git a/packages/babel-traverse/src/path/evaluation.ts b/packages/babel-traverse/src/path/evaluation.ts
@@ -444,8 +444,11 @@ function _evaluate(path: NodePath, state: State): any {
         !isInvalidMethod(property.node.name)
       ) {
         context = global[object.node.name];
-        // @ts-expect-error property may not exist in context object
-        func = context[property.node.name];
+        const key = property.node.name;
+        // TODO(Babel 8): Use Object.hasOwn
+        if (Object.hasOwnProperty.call(context, key)) {
+          func = context[key as keyof typeof context];
+        }
       }
 
       // "abc".charCodeAt(4)

diff --git a/packages/babel-traverse/test/evaluation.js b/packages/babel-traverse/test/evaluation.js
@@ -152,6 +152,12 @@ describe("evaluation", function () {
     expect(eval_invalid_call.confident).toBe(false);
   });
 
+  it("should not evaluate inherited methods", function () {
+    const path = getPath("Math.hasOwnProperty('min')");
+    const evalResult = path.get("body.0.expression").evaluate();
+    expect(evalResult.confident).toBe(false);
+  });
+
   it("should evaluate global call expressions", function () {
     expect(
       getPath("isFinite(1);").get("body.0.expression").evaluate().value,