Preserve tasks named __proto__ in auto and autoInject

lib/auto.js

@@ -3,6 +3,19 @@ import onlyOnce from './internal/onlyOnce.js'
 import wrapAsync from './internal/wrapAsync.js'
 import { promiseCallback, PROMISE_SYMBOL } from './internal/promiseCallback.js'
 
+function setResult(results, key, value) {
+    if (key === '__proto__') {
+        Object.defineProperty(results, key, {
+            value,
+            writable: true,
+            enumerable: true,
+            configurable: true
+        });
+    } else {
+        results[key] = value;
+    }
+}
+
 /**
  * Determines the best order for running the {@link AsyncFunction}s in `tasks`, based on
  * their requirements. Each function can optionally depend on other functions
@@ -175,7 +188,7 @@ export default function auto(tasks, concurrency, callback) {
     // for cycle detection:
     var readyToCheck = []; // tasks that have been identified as reachable
     // without the possibility of returning to an ancestor task
-    var uncheckedDependencies = {};
+    var uncheckedDependencies = Object.create(null);
 
     Object.keys(tasks).forEach(key => {
         var task = tasks[key]
@@ -261,15 +274,15 @@ export default function auto(tasks, concurrency, callback) {
             if (err) {
                 var safeResults = {};
                 Object.keys(results).forEach(rkey => {
-                    safeResults[rkey] = results[rkey];
+                    setResult(safeResults, rkey, results[rkey]);
                 });
-                safeResults[key] = result;
+                setResult(safeResults, key, result);
                 hasError = true;
                 listeners = Object.create(null);
                 if (canceled) return
                 callback(err, safeResults);
             } else {
-                results[key] = result;
+                setResult(results, key, result);
                 taskComplete(key);
             }
         });

lib/autoInject.js

@@ -140,7 +140,7 @@ function parseParams(func) {
  * });
  */
 export default function autoInject(tasks, callback) {
-    var newTasks = {};
+    var newTasks = Object.create(null);
 
     Object.keys(tasks).forEach(key => {
         var taskFn = tasks[key]

test/auto-special-keys.js

@@ -0,0 +1,73 @@
+var async = require('../lib');
+var assert = require('assert');
+
+describe('auto special task keys review', () => {
+    function assertOwnResult(results, key, value) {
+        assert.strictEqual(Object.getPrototypeOf(results), Object.prototype);
+        assert.deepStrictEqual(Object.getOwnPropertyDescriptor(results, key), {
+            value,
+            writable: true,
+            enumerable: true,
+            configurable: true
+        });
+    }
+
+    [undefined, null, 42, 'value', {value: true}].forEach((value, index) => {
+        it('preserves an independent special task result ' + index, (done) => {
+            async.auto({
+                ['__proto__']: callback => callback(null, value)
+            }, (err, results) => {
+                assert.ifError(err);
+                assertOwnResult(results, '__proto__', value);
+                done();
+            });
+        });
+    });
+
+    it('runs a special task with dependencies and exposes its result downstream', (done) => {
+        async.auto({
+            first: callback => callback(null, 2),
+            ['__proto__']: ['first', (results, callback) => callback(null, results.first + 3)],
+            last: ['__proto__', (results, callback) => callback(null, results.__proto__ + 5)]
+        }, (err, results) => {
+            assert.ifError(err);
+            assertOwnResult(results, '__proto__', 5);
+            assert.strictEqual(results.last, 10);
+            done();
+        });
+    });
+
+    it('preserves the special task in partial results when another task fails', (done) => {
+        var error = new Error('failure');
+        async.auto({
+            ['__proto__']: callback => callback(null, 'finished'),
+            failed: ['__proto__', (results, callback) => callback(error, 'partial')]
+        }, (err, results) => {
+            assert.strictEqual(err, error);
+            assertOwnResult(results, '__proto__', 'finished');
+            assert.strictEqual(results.failed, 'partial');
+            done();
+        });
+    });
+
+    it('preserves partial results returned by a failing special task', (done) => {
+        var error = new Error('failure');
+        async.auto({
+            first: callback => callback(null, 'finished'),
+            ['__proto__']: callback => callback(error, 'partial')
+        }, (err, results) => {
+            assert.strictEqual(err, error);
+            assertOwnResult(results, '__proto__', 'partial');
+            assert.strictEqual(results.first, 'finished');
+            done();
+        });
+    });
+
+    it('returns special task results through a promise', async () => {
+        var results = await async.auto({
+            first: callback => callback(null, 7),
+            ['__proto__']: ['first', (values, callback) => callback(null, values.first)]
+        });
+        assertOwnResult(results, '__proto__', 7);
+    });
+});

test/autoInject-special-keys.js

@@ -0,0 +1,42 @@
+var async = require('../lib');
+var assert = require('assert');
+
+describe('autoInject special task keys review', () => {
+    it('preserves an independent special task', (done) => {
+        async.autoInject({
+            ['__proto__']: callback => callback(null, 2)
+        }, (err, results) => {
+            assert.ifError(err);
+            assert.strictEqual(Object.getPrototypeOf(results), Object.prototype);
+            assert.strictEqual(Object.prototype.hasOwnProperty.call(results, '__proto__'), true);
+            assert.strictEqual(results.__proto__, 2);
+            done();
+        });
+    });
+
+    it('injects the special task result using explicit dependencies', (done) => {
+        async.autoInject({
+            first: callback => callback(null, 2),
+            ['__proto__']: ['first', (first, callback) => callback(null, first + 3)],
+            last: ['__proto__', (value, callback) => callback(null, value + 5)]
+        }, (err, results) => {
+            assert.ifError(err);
+            assert.strictEqual(results.last, 10);
+            assert.strictEqual(Object.getOwnPropertyDescriptor(results, '__proto__').value, 5);
+            done();
+        });
+    });
+
+    it('injects the special task result using named parameters', (done) => {
+        async.autoInject({
+            ['__proto__']: callback => callback(null, 4),
+            last(__proto__, callback) {
+                callback(null, __proto__ + 1);
+            }
+        }, (err, results) => {
+            assert.ifError(err);
+            assert.strictEqual(results.last, 5);
+            done();
+        });
+    });
+});