Repository navigation
fix(amplify-velocity-template): consistent handling of reserved property names in reference resolution - #14992
Merged
sharonyajain merged 4 commits intoNov 2, 2026
Conversation
…rty names in reference resolution Follow-on to PR aws-amplify#14964. The initial change made the reference resolver skip a set of reserved property names but left three paths that still resolved or wrote them: the getter case-normalized second lookup, the set/put/setX write branches, and the set.js setValue path walk. Apply the same reserved-name check in all three. Adds tests/reserved-property-names.test.js.
sharonyajain
marked this pull request as ready for review
October 23, 2026 12:17
… strengthen write-path tests Extract the prototype-chain denylist and isBlockedProperty into a single reserved-properties module imported by both references.js and set.js, so the two copies can no longer drift and silently reopen the pollution vector for a name added to only one list. Make the two write-path regression tests discriminating: put now exercises "constructor" (an own-key write that fails without the guard) instead of the spec-ignored string assignment to __proto__, and the setter accessor test uses the lowercase "setconstructor" slice that the guard actually matches instead of the capitalized form that never reached it. Verified by mutation: disabling the guard now fails both tests.
sharonyajain
left a comment
sharonyajain
left a comment
Contributor
There was a problem hiding this comment.
✅ Good to ship: No blocking issues; 2 should-fix notes — the reserved-name denylist is duplicated across set.js/references.js (drift risk that could reopen the vuln) and two write-path regression tests pass even without the patch.
2 should-fix 🟡 (non-blocking)
[code-review-sage]
soberm
reviewed
Oct 30, 2026
…emove() Reserved names were still reachable through paths that bypassed the shared accessors: - the root identifier of a reference ($constructor, $__proto__), read from the render context and from #foreach/#macro local scopes, which are plain objects whose `in` checks match inherited names - the root identifier of #set, both with and without a property path - remove(), which read and deleted a computed key unchecked Route these through the shared denylist, use an own-property check for the full-text context lookup, and make a rejected setX(...) render '' like the other rejected writes. The #set path walk now relies on the accessors instead of a separate pre-check, and the module comment no longer claims coverage it did not have.
soberm
approved these changes
Oct 30, 2026
soberm
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on to #14964, which made the VTL reference resolver skip a set of reserved property names but left three code paths that still resolved or wrote those names. This makes the handling consistent across all of them.
What changed
getter()case-normalized lookup (src/compile/references.js) —getter()only checked its firstbase[property]lookup. When that returnsundefined, it re-cases the property name (for examplegetConstructor()->Constructor-> lowercasedconstructor) and does a second lookup with no check, so a reserved name still resolved through the re-cased path. Added the same reserved-name check before both lookups.Write branches in
getPropMethod(src/compile/references.js) —set("k", v),put("k", v), and thesetX(v)accessor (baseRef[id.slice(3)] = ...) assigned to a computed key without the same check the read paths use. Each computed key is now checked before the write.setValue()#setpath walk (src/compile/set.js) — the#setdirective walksref.pathdoingbaseRef[key] = valper segment with no check (for example#set($x.__proto__.foo = ...)). Added a local copy of the reserved-name list (no cross-module import) and check every path segment before traversal and write.The generic method fall-through is left as-is; the existing top-level guard already covers a literal reserved name there.
Tests
Adds
tests/reserved-property-names.test.js(matching the existing test style): the getter re-cased path,get("constructor")/get("__proto__"), the#setpath walk, and theput/setwrite cases all resolve to empty and leaveObject.prototypeuntouched, while normal getters /#set/putstill work as before.mocha tests: 166 passing, 0 failing (13 new assertions, no regressions).