chore: initialize Records with null prototype objects (#7652)

Author: addaleax

packages/compass-crud/src/components/change-view/bson-utils.ts

@@ -21,7 +21,7 @@ export function unBSON(value: any): any {
   if (shape === 'array') {
     return value.map(unBSON);
   } else if (shape === 'object') {
-    const mapped: Record<string, any> = {};
+    const mapped: Record<string, any> = Object.create(null);
     for (const [k, v] of Object.entries(value)) {
       mapped[k] = unBSON(v);
     }

packages/compass-crud/src/components/table-view/document-table-view.tsx

@@ -224,7 +224,7 @@ export class DocumentTableView extends React.Component<DocumentTableViewProps> {
   onColumnResized(event: ColumnResizedEvent) {
     if (event.finished) {
       const columnState = this.columnApi?.getColumnState() || [];
-      const currentColumnWidths: Record<string, number> = {};
+      const currentColumnWidths: Record<string, number> = Object.create(null);
       for (const column of columnState) {
         if (column.width) currentColumnWidths[column.colId] = column.width;
       }
@@ -888,8 +888,11 @@ export class DocumentTableView extends React.Component<DocumentTableViewProps> {
     path: (string | number)[],
     types: TableHeaderType[]
   ): ColDef[] => {
-    const headers: Record<string, ColDef> = {};
-    const headerTypes: Record<string, Record<string, TableHeaderType>> = {};
+    const headers: Record<string, ColDef> = Object.create(null);
+    const headerTypes: Record<
+      string,
+      Record<string, TableHeaderType>
+    > = Object.create(null);
     const isEditable = this.props.isEditable;
     const parentType = types.length ? types[types.length - 1] : 'Object';
 
@@ -944,7 +947,7 @@ export class DocumentTableView extends React.Component<DocumentTableViewProps> {
      the grid. This is handled here for the initial header values, and then
      in the GridStore for any subsequent updates. */
     const columnHeaders = Object.values(headers);
-    const showing: Record<string, TableHeaderType> = {};
+    const showing: Record<string, TableHeaderType> = Object.create(null);
 
     map(headerTypes, function (oids, key) {
       const colTypes = Object.values(oids);

packages/compass-crud/src/stores/crud-store.spec.ts

@@ -2719,7 +2719,7 @@ describe('store', function () {
     let fakeSetItem: (key: string, value: string) => void;
 
     beforeEach(function () {
-      const localStorageValues: Record<string, string> = {};
+      const localStorageValues: Record<string, string> = Object.create(null);
       fakeGetItem = sinon.fake((key: string) => {
         return localStorageValues[key];
       });

packages/compass-crud/src/stores/grid-store.ts

@@ -333,7 +333,7 @@ class GridStoreImpl
    * @param {Boolean} isArray - If the parent of the element is an array.
    */
   elementRemoved(key: string, oid: string, isArray: boolean) {
-    const params: Record<string, unknown> = {};
+    const params: Record<string, unknown> = Object.create(null);
     const newShowing: typeof this.showing = {};
 
     /* If it's an array element, need to move subsequent elements up */

packages/compass-electron-menu/src/application-menu.spec.tsx

@@ -130,7 +130,7 @@ describe('application-menu / useApplicationMenu', function () {
 
     const handlerUndoA = () => {};
     const handlerRedoA = () => {};
-    let roles: Record<string, () => void> = {
+    let roles: Readonly<Record<string, () => void>> = {
       undo: handlerUndoA,
       redo: handlerRedoA,
     };

packages/data-service/src/data-service.ts

@@ -1194,6 +1194,7 @@ class DataServiceImpl extends WithLogContext implements DataService {
 
       // Build the aggregation pipeline dynamically based on collection type
       const groupStage: Record<string, unknown> = {
+        __proto__: null,
         _id: null,
         capped: { $first: '$storageStats.capped' },
         count: { $sum: '$storageStats.count' },
@@ -1230,6 +1231,7 @@ class DataServiceImpl extends WithLogContext implements DataService {
 
       const addFieldsStage: Record<string, unknown> = {
         // `avgObjSize` is the average of per-shard `avgObjSize` weighted by `count`
+        __proto__: null,
         avgObjSize: {
           $cond: {
             if: { $ne: ['$count', 0] },

packages/hadron-document/src/object-generator.ts

@@ -89,7 +89,7 @@ export class ObjectGenerator {
     options: ObjectGeneratorOptions = {}
   ): Record<string, unknown> {
     if (elements) {
-      const object: Record<string, unknown> = {};
+      const object: Record<string, unknown> = Object.create(null);
       for (const element of elements) {
         if (options.excludeInternalFields && element.isInternalField()) {
           continue;
@@ -118,7 +118,7 @@ export class ObjectGenerator {
     options: ObjectGeneratorOptions = {}
   ): Record<string, unknown> {
     if (elements) {
-      const object: Record<string, unknown> = {};
+      const object: Record<string, unknown> = Object.create(null);
       for (const element of elements) {
         if (options.excludeInternalFields && element.isInternalField()) {
           continue;

packages/mongodb-query-util/src/in-value-range.ts

@@ -38,7 +38,9 @@ export const inValueRange = (
   field: any,
   d: { value: any; dx?: number; bson?: any }
 ) => {
-  const compOperators: Record<string, (a: number, b: number) => boolean> = {
+  const compOperators: Readonly<
+    Record<string, (a: number, b: number) => boolean>
+  > = {
     $gte: function (a: number, b: number) {
       return a >= b;
     },