Skip to content

fix(router): use null-prototype objects for parsed URL params#67879

Open
gnesher wants to merge 1 commit intoangular:mainfrom
gnesher:fix/router-query-param-hasownproperty
Open

fix(router): use null-prototype objects for parsed URL params#67879
gnesher wants to merge 1 commit intoangular:mainfrom
gnesher:fix/router-query-param-hasownproperty

Conversation

@gnesher
Copy link

@gnesher gnesher commented Mar 26, 2026

A query parameter named hasOwnProperty overwrites the inherited Object method on the params accumulator, causing a TypeError on the next parameter. Use Object.prototype.hasOwnProperty.call() instead, consistent with the safe pattern already used in ParamsAsMap (shared.ts line 83).

PR Checklist

Please check if your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Documentation content changes
  • angular.dev application / infrastructure changes
  • Other... Please describe:

What is the new behavior?

Does this PR introduce a breaking change?

  • Yes
  • No

A query parameter named `hasOwnProperty` overwrites the inherited
Object method on the params accumulator, causing a TypeError on the
next parameter. Use `Object.create(null)` for both query and matrix
param accumulators so no prototype methods can be clobbered, and
`Object.prototype.hasOwnProperty.call()` for the duplicate-key check,
consistent with the safe pattern already used in `ParamsAsMap`
(`shared.ts` line 83).

Made-with: Cursor
@pullapprove pullapprove bot requested a review from kirjs March 26, 2026 07:39
@google-cla

This comment was marked as outdated.

@ngbot ngbot bot added this to the Backlog milestone Mar 26, 2026
@JeanMeche JeanMeche requested review from atscott and removed request for kirjs March 26, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant