Harden property accessors against untrusted keys

[12joan]

Description
It's sometimes possible to cause mischief in JavaScript by supplying unexpected keys to square bracket property accessors. These unexpected keys can come from unexpected places. For example, path.length might be a non-number if a user is able to supply a path of { length: 'Untrusted value' } as part of JSON input, such as serialised operations.

I've gone through and hardened every property accessor I could find where it's remotely possible that an untrusted key might be used with harmful consequences.

As part of this, I've banned set_node operations from shadowing any property on the Object prototype (e.g. __proto__, toString, hasOwnProperty), since overwriting these default properties may cause unexpected behaviour.

The list of banned properties is currently: toString, toLocaleString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, __defineGetter__, __defineSetter__, __lookupGetter__, __lookupSetter__, __proto__, constructor. This list is subject to change automatically as new properties are added to Object.prototype, but I think the risk of a collision between a future prototype property and a genuine user-supplied property name is very small.

Checks

• The new code matches the existing patterns and styles.
• The tests pass with yarn test.
• The linter passes with yarn lint. (Fix errors with yarn fix.)
• The relevant examples still work. (Run examples with yarn start.)
• You've added a changeset if changing functionality. (Add one with yarn changeset add.)

[changeset-bot]

🦋 Changeset detected

Latest commit: 2e03e4b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
slate-dom	Patch
slate	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[zbeyens]

@codex review (just trying)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 778fbb2692

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".