Merge commit from fork

* fix: Disallow `__proto__` keys in more circumstances

* remove unflatten tests

Author: elliott-with-the-longest-name-on-github

.changeset/cool-icons-jog.md

@@ -0,0 +1,7 @@
+---
+'devalue': patch
+---
+
+fix: reject `__proto__` keys in malformed `Object` wrapper payloads
+
+This validates the `"Object"` parse path and throws when the wrapped value has an own `__proto__` key.

.changeset/green-candles-talk.md

@@ -0,0 +1,7 @@
+---
+'devalue': patch
+---
+
+fix: disallow `__proto__` keys in null-prototype object parsing
+
+This disallows `__proto__` keys in the `"null"` parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

src/parse.js

@@ -118,7 +118,13 @@ export function unflatten(parsed, revivers) {
 						break;
 
 					case 'Object':
-						hydrated[index] = Object(value[1]);
+						const object = Object(value[1]);
+
+						if (Object.hasOwn(object, '__proto__')) {
+							throw new Error('Cannot parse an object with a `__proto__` property');
+						}
+
+						hydrated[index] = object;
 						break;
 
 					case 'BigInt':
@@ -129,6 +135,10 @@ export function unflatten(parsed, revivers) {
 						const obj = Object.create(null);
 						hydrated[index] = obj;
 						for (let i = 1; i < value.length; i += 2) {
+							if (value[i] === '__proto__') {
+								throw new Error('Cannot parse an object with a `__proto__` property');
+							}
+
 							obj[value[i]] = hydrate(value[i + 1]);
 						}
 						break;

test/test.js

@@ -836,6 +836,26 @@ const invalid = [
 		json: '[{"__proto__":1},{}]',
 		message: 'Cannot parse an object with a `__proto__` property'
 	},
+	{
+		name: 'prototype pollution via null-prototype object',
+		json: '[["null","__proto__",1],{}]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
+	{
+		name: 'nested prototype pollution via null-prototype object',
+		json: '[{"data":1},["null","__proto__",2],{"polluted":3},true]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
+	{
+		name: 'prototype pollution via Object wrapper',
+		json: '[["Object",{"__proto__":1}],{}]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
+	{
+		name: 'nested prototype pollution via Object wrapper',
+		json: '[{"wrapped":1},["Object",{"__proto__":2}],{}]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
 	{
 		name: 'bad index',
 		json: '[{"0":1,"toString":"push"},"hello"]',