Fix: Lint no-prototype-builtins (#5920)

* Fix: Lint no-prototype-builtins

Closes: https://github.com/parse-community/parse-server/issues/5842

Reference: https://eslint.org/docs/rules/no-prototype-builtins

* replace Object.hasOwnProperty.call

.eslintrc.json

@@ -23,7 +23,6 @@
         "prefer-const": "error",
         "space-infix-ops": "error",
         "no-useless-escape": "off",
-        "no-prototype-builtins": "off",
         "require-atomic-updates": "off"
     }
 }

spec/ParseQuery.Aggregate.spec.js

@@ -127,9 +127,15 @@ describe('Parse.Query Aggregate testing', () => {
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
         expect(resp.results.length).toBe(3);
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
-        expect(resp.results[1].hasOwnProperty('objectId')).toBe(true);
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
-        expect(resp.results[2].hasOwnProperty('objectId')).toBe(true);
+        ).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[1], 'objectId')
+        ).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[2], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).not.toBe(undefined);
         expect(resp.results[1].objectId).not.toBe(undefined);
         expect(resp.results[2].objectId).not.toBe(undefined);
@@ -148,9 +154,15 @@ describe('Parse.Query Aggregate testing', () => {
     });
     const resp = await get(Parse.serverURL + '/aggregate/TestObject', options);
     expect(resp.results.length).toBe(3);
-    expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+    expect(
-    expect(resp.results[1].hasOwnProperty('objectId')).toBe(true);
+      Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
-    expect(resp.results[2].hasOwnProperty('objectId')).toBe(true);
+    ).toBe(true);
+    expect(
+      Object.prototype.hasOwnProperty.call(resp.results[1], 'objectId')
+    ).toBe(true);
+    expect(
+      Object.prototype.hasOwnProperty.call(resp.results[2], 'objectId')
+    ).toBe(true);
     expect(resp.results[0].objectId).not.toBe(undefined);
     expect(resp.results[1].objectId).not.toBe(undefined);
     expect(resp.results[2].objectId).not.toBe(undefined);
@@ -371,8 +383,12 @@ describe('Parse.Query Aggregate testing', () => {
       expect(results.length).toEqual(4);
       for (let i = 0; i < results.length; i++) {
         const item = results[i];
-        expect(item.hasOwnProperty('updatedAt')).toEqual(true);
+        expect(Object.prototype.hasOwnProperty.call(item, 'updatedAt')).toEqual(
-        expect(item.hasOwnProperty('objectId')).toEqual(false);
+          true
+        );
+        expect(Object.prototype.hasOwnProperty.call(item, 'objectId')).toEqual(
+          false
+        );
       }
       done();
     });
@@ -482,7 +498,9 @@ describe('Parse.Query Aggregate testing', () => {
     });
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).toBe(null);
         expect(resp.results[0].total).toBe(50);
         done();
@@ -498,7 +516,9 @@ describe('Parse.Query Aggregate testing', () => {
     });
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).toBe(null);
         expect(resp.results[0].total).toBe(4);
         done();
@@ -514,7 +534,9 @@ describe('Parse.Query Aggregate testing', () => {
     });
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).toBe(null);
         expect(resp.results[0].minScore).toBe(10);
         done();
@@ -530,7 +552,9 @@ describe('Parse.Query Aggregate testing', () => {
     });
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).toBe(null);
         expect(resp.results[0].maxScore).toBe(20);
         done();
@@ -546,7 +570,9 @@ describe('Parse.Query Aggregate testing', () => {
     });
     get(Parse.serverURL + '/aggregate/TestObject', options)
       .then(resp => {
-        expect(resp.results[0].hasOwnProperty('objectId')).toBe(true);
+        expect(
+          Object.prototype.hasOwnProperty.call(resp.results[0], 'objectId')
+        ).toBe(true);
         expect(resp.results[0].objectId).toBe(null);
         expect(resp.results[0].avgScore).toBe(12.5);
         done();
@@ -966,7 +992,9 @@ describe('Parse.Query Aggregate testing', () => {
       .then(resp => {
         expect(resp.results.length).toBe(2);
         resp.results.forEach(result => {
-          expect(result.hasOwnProperty('objectId')).toBe(true);
+          expect(Object.prototype.hasOwnProperty.call(result, 'objectId')).toBe(
+            true
+          );
           expect(result.name).toBe(undefined);
           expect(result.sender).toBe(undefined);
           expect(result.size).toBe(undefined);

spec/Schema.spec.js

@@ -1382,19 +1382,29 @@ describe('SchemaController', () => {
 
   it('properly handles volatile _Schemas', done => {
     function validateSchemaStructure(schema) {
-      expect(schema.hasOwnProperty('className')).toBe(true);
+      expect(Object.prototype.hasOwnProperty.call(schema, 'className')).toBe(
-      expect(schema.hasOwnProperty('fields')).toBe(true);
+        true
-      expect(schema.hasOwnProperty('classLevelPermissions')).toBe(true);
+      );
+      expect(Object.prototype.hasOwnProperty.call(schema, 'fields')).toBe(true);
+      expect(
+        Object.prototype.hasOwnProperty.call(schema, 'classLevelPermissions')
+      ).toBe(true);
     }
     function validateSchemaDataStructure(schemaData) {
       Object.keys(schemaData).forEach(className => {
         const schema = schemaData[className];
         // Hooks has className...
         if (className != '_Hooks') {
-          expect(schema.hasOwnProperty('className')).toBe(false);
+          expect(
+            Object.prototype.hasOwnProperty.call(schema, 'className')
+          ).toBe(false);
         }
-        expect(schema.hasOwnProperty('fields')).toBe(false);
+        expect(Object.prototype.hasOwnProperty.call(schema, 'fields')).toBe(
-        expect(schema.hasOwnProperty('classLevelPermissions')).toBe(false);
+          false
+        );
+        expect(
+          Object.prototype.hasOwnProperty.call(schema, 'classLevelPermissions')
+        ).toBe(false);
       });
     }
     let schema;

spec/VerifyUserPassword.spec.js

@@ -469,8 +469,12 @@ describe('Verify User Password', () => {
         const res = response.data;
         expect(typeof res).toBe('object');
         expect(typeof res['objectId']).toEqual('string');
-        expect(res.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(res.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(res, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(res, 'password')).toEqual(
+          false
+        );
         done();
       })
       .catch(err => {
@@ -493,8 +497,12 @@ describe('Verify User Password', () => {
         const res = response.data;
         expect(typeof res).toBe('object');
         expect(typeof res['objectId']).toEqual('string');
-        expect(res.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(res.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(res, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(res, 'password')).toEqual(
+          false
+        );
         done();
       });
   });
@@ -513,8 +521,12 @@ describe('Verify User Password', () => {
         const res = response.data;
         expect(typeof res).toBe('object');
         expect(typeof res['objectId']).toEqual('string');
-        expect(res.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(res.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(res, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(res, 'password')).toEqual(
+          false
+        );
         done();
       });
   });
@@ -544,8 +556,12 @@ describe('Verify User Password', () => {
         expect(typeof res).toBe('string');
         const body = JSON.parse(res);
         expect(typeof body['objectId']).toEqual('string');
-        expect(body.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(body.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(body, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(body, 'password')).toEqual(
+          false
+        );
         done();
       });
   });
@@ -575,8 +591,12 @@ describe('Verify User Password', () => {
         expect(typeof res).toBe('string');
         const body = JSON.parse(res);
         expect(typeof body['objectId']).toEqual('string');
-        expect(body.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(body.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(body, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(body, 'password')).toEqual(
+          false
+        );
         done();
       });
   });
@@ -603,8 +623,12 @@ describe('Verify User Password', () => {
         const res = response.data;
         expect(typeof res).toBe('object');
         expect(typeof res['objectId']).toEqual('string');
-        expect(res.hasOwnProperty('sessionToken')).toEqual(false);
+        expect(
-        expect(res.hasOwnProperty('password')).toEqual(false);
+          Object.prototype.hasOwnProperty.call(res, 'sessionToken')
+        ).toEqual(false);
+        expect(Object.prototype.hasOwnProperty.call(res, 'password')).toEqual(
+          false
+        );
         done();
       });
   });

src/Adapters/Auth/index.js

@@ -67,7 +67,7 @@ function loadAuthAdapter(provider, authOptions) {
   const providerOptions = authOptions[provider];
   if (
     providerOptions &&
-    providerOptions.hasOwnProperty('oauth2') &&
+    Object.prototype.hasOwnProperty.call(providerOptions, 'oauth2') &&
     providerOptions['oauth2'] === true
   ) {
     defaultAdapter = oauth2;

src/Adapters/Storage/Mongo/MongoStorageAdapter.js

@@ -279,7 +279,7 @@ export class MongoStorageAdapter implements StorageAdapter {
         delete existingIndexes[name];
       } else {
         Object.keys(field).forEach(key => {
-          if (!fields.hasOwnProperty(key)) {
+          if (!Object.prototype.hasOwnProperty.call(fields, key)) {
             throw new Parse.Error(
               Parse.Error.INVALID_QUERY,
               `Field ${key} does not exist, cannot add index.`
@@ -795,7 +795,7 @@ export class MongoStorageAdapter implements StorageAdapter {
       )
       .then(results => {
         results.forEach(result => {
-          if (result.hasOwnProperty('_id')) {
+          if (Object.prototype.hasOwnProperty.call(result, '_id')) {
             if (isPointerField && result._id) {
               result._id = result._id.split('$')[1];
             }
@@ -1024,7 +1024,7 @@ export class MongoStorageAdapter implements StorageAdapter {
       const existingIndexes = schema.indexes;
       for (const key in existingIndexes) {
         const index = existingIndexes[key];
-        if (index.hasOwnProperty(fieldName)) {
+        if (Object.prototype.hasOwnProperty.call(index, fieldName)) {
           return Promise.resolve();
         }
       }

src/Adapters/Storage/Mongo/MongoTransform.js

@@ -1282,7 +1282,7 @@ const nestedMongoObjectToNestedParseObject = mongoObject => {
       }
 
       if (
-        mongoObject.hasOwnProperty('__type') &&
+        Object.prototype.hasOwnProperty.call(mongoObject, '__type') &&
         mongoObject.__type == 'Date' &&
         mongoObject.iso instanceof Date
       ) {

src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

@@ -903,7 +903,7 @@ export class PostgresStorageAdapter implements StorageAdapter {
         delete existingIndexes[name];
       } else {
         Object.keys(field).forEach(key => {
-          if (!fields.hasOwnProperty(key)) {
+          if (!Object.prototype.hasOwnProperty.call(fields, key)) {
             throw new Parse.Error(
               Parse.Error.INVALID_QUERY,
               `Field ${key} does not exist, cannot add index.`
@@ -2219,7 +2219,12 @@ export class PostgresStorageAdapter implements StorageAdapter {
       }
       if (stage.$match) {
         const patterns = [];
-        const orOrAnd = stage.$match.hasOwnProperty('$or') ? ' OR ' : ' AND ';
+        const orOrAnd = Object.prototype.hasOwnProperty.call(
+          stage.$match,
+          '$or'
+        )
+          ? ' OR '
+          : ' AND ';
 
         if (stage.$match.$or) {
           const collapse = {};
@@ -2294,7 +2299,7 @@ export class PostgresStorageAdapter implements StorageAdapter {
       )
       .then(results => {
         results.forEach(result => {
-          if (!result.hasOwnProperty('objectId')) {
+          if (!Object.prototype.hasOwnProperty.call(result, 'objectId')) {
             result.objectId = null;
           }
           if (groupValues) {

src/Controllers/DatabaseController.js

@@ -119,7 +119,7 @@ const validateQuery = (
          */
         Object.keys(query).forEach(key => {
           const noCollisions = !query.$or.some(subq =>
-            Object.hasOwnProperty.call(subq, key)
+            Object.prototype.hasOwnProperty.call(subq, key)
           );
           let hasNears = false;
           if (query[key] != null && typeof query[key] == 'object') {
@@ -1487,7 +1487,7 @@ class DatabaseController {
           [key]: userPointer,
         };
         // if we already have a constraint on the key, use the $and
-        if (query.hasOwnProperty(key)) {
+        if (Object.prototype.hasOwnProperty.call(query, key)) {
           return { $and: [q, query] };
         }
         // otherwise just add the constaint

src/Controllers/PushController.js

@@ -32,7 +32,10 @@ export class PushController {
     }
 
     // Immediate push
-    if (body.expiration_interval && !body.hasOwnProperty('push_time')) {
+    if (
+      body.expiration_interval &&
+      !Object.prototype.hasOwnProperty.call(body, 'push_time')
+    ) {
       const ttlMs = body.expiration_interval * 1000;
       body.expiration_time = new Date(now.valueOf() + ttlMs).valueOf();
     }
@@ -121,7 +124,7 @@ export class PushController {
       })
       .then(() => {
         if (
-          body.hasOwnProperty('push_time') &&
+          Object.prototype.hasOwnProperty.call(body, 'push_time') &&
           config.hasPushScheduledSupport
         ) {
           return Promise.resolve();
@@ -147,7 +150,10 @@ export class PushController {
    * @returns {Number|undefined} The expiration time if it exists in the request
    */
   static getExpirationTime(body = {}) {
-    var hasExpirationTime = body.hasOwnProperty('expiration_time');
+    var hasExpirationTime = Object.prototype.hasOwnProperty.call(
+      body,
+      'expiration_time'
+    );
     if (!hasExpirationTime) {
       return;
     }
@@ -174,7 +180,10 @@ export class PushController {
   }
 
   static getExpirationInterval(body = {}) {
-    const hasExpirationInterval = body.hasOwnProperty('expiration_interval');
+    const hasExpirationInterval = Object.prototype.hasOwnProperty.call(
+      body,
+      'expiration_interval'
+    );
     if (!hasExpirationInterval) {
       return;
     }
@@ -198,7 +207,7 @@ export class PushController {
    * @returns {Number|undefined} The push time if it exists in the request
    */
   static getPushTime(body = {}) {
-    var hasPushTime = body.hasOwnProperty('push_time');
+    var hasPushTime = Object.prototype.hasOwnProperty.call(body, 'push_time');
     if (!hasPushTime) {
       return;
     }

src/LiveQuery/ParseLiveQueryServer.js

@@ -600,7 +600,10 @@ class ParseLiveQueryServer {
     ) {
       return false;
     }
-    if (!request || !request.hasOwnProperty('masterKey')) {
+    if (
+      !request ||
+      !Object.prototype.hasOwnProperty.call(request, 'masterKey')
+    ) {
       return false;
     }
     return request.masterKey === validKeyPairs.get('masterKey');
@@ -623,7 +626,7 @@ class ParseLiveQueryServer {
 
   _handleSubscribe(parseWebsocket: any, request: any): any {
     // If we can not find this client, return error to client
-    if (!parseWebsocket.hasOwnProperty('clientId')) {
+    if (!Object.prototype.hasOwnProperty.call(parseWebsocket, 'clientId')) {
       Client.pushError(
         parseWebsocket,
         2,
@@ -699,7 +702,7 @@ class ParseLiveQueryServer {
     notifyClient: boolean = true
   ): any {
     // If we can not find this client, return error to client
-    if (!parseWebsocket.hasOwnProperty('clientId')) {
+    if (!Object.prototype.hasOwnProperty.call(parseWebsocket, 'clientId')) {
       Client.pushError(
         parseWebsocket,
         2,

src/LiveQuery/QueryTools.js

@@ -13,7 +13,7 @@ var Parse = require('parse/node');
  * Convert $or queries into an array of where conditions
  */
 function flattenOrQueries(where) {
-  if (!where.hasOwnProperty('$or')) {
+  if (!Object.prototype.hasOwnProperty.call(where, '$or')) {
     return where;
   }
   var accum = [];

src/ParseServer.js

@@ -356,12 +356,12 @@ function addParseCloud() {
 
 function injectDefaults(options: ParseServerOptions) {
   Object.keys(defaults).forEach(key => {
-    if (!options.hasOwnProperty(key)) {
+    if (!Object.prototype.hasOwnProperty.call(options, key)) {
       options[key] = defaults[key];
     }
   });
 
-  if (!options.hasOwnProperty('serverURL')) {
+  if (!Object.prototype.hasOwnProperty.call(options, 'serverURL')) {
     options.serverURL = `http://localhost:${options.port}${options.mountPath}`;
   }
 

src/Push/utils.js

@@ -132,7 +132,7 @@ export function validatePushType(where = {}, validPushTypes = []) {
 
 export function applyDeviceTokenExists(where) {
   where = deepcopy(where);
-  if (!where.hasOwnProperty('deviceToken')) {
+  if (!Object.prototype.hasOwnProperty.call(where, 'deviceToken')) {
     where['deviceToken'] = { $exists: true };
   }
   return where;

src/RestQuery.js

@@ -71,7 +71,7 @@ function RestQuery(
 
   // If we have keys, we probably want to force some includes (n-1 level)
   // See issue: https://github.com/parse-community/parse-server/issues/3185
-  if (restOptions.hasOwnProperty('keys')) {
+  if (Object.prototype.hasOwnProperty.call(restOptions, 'keys')) {
     const keysForInclude = restOptions.keys
       .split(',')
       .filter(key => {

src/RestWrite.js

@@ -1711,7 +1711,7 @@ RestWrite.prototype._updateResponseWithData = function(response, data) {
   this.storage.fieldsChangedByTrigger.forEach(fieldName => {
     const dataValue = data[fieldName];
 
-    if (!response.hasOwnProperty(fieldName)) {
+    if (!Object.prototype.hasOwnProperty.call(response, fieldName)) {
       response[fieldName] = dataValue;
     }
 

src/Routers/AggregateRouter.js

@@ -122,13 +122,13 @@ export class AggregateRouter extends ClassesRouter {
       );
     }
     if (stageName === 'group') {
-      if (stage[stageName].hasOwnProperty('_id')) {
+      if (Object.prototype.hasOwnProperty.call(stage[stageName], '_id')) {
         throw new Parse.Error(
           Parse.Error.INVALID_QUERY,
           `Invalid parameter for query: group. Please use objectId instead of _id`
         );
       }
-      if (!stage[stageName].hasOwnProperty('objectId')) {
+      if (!Object.prototype.hasOwnProperty.call(stage[stageName], 'objectId')) {
         throw new Parse.Error(
           Parse.Error.INVALID_QUERY,
           `Invalid parameter for query: group. objectId is required`

src/Routers/UsersRouter.js

@@ -20,7 +20,7 @@ export class UsersRouter extends ClassesRouter {
    */
   static removeHiddenProperties(obj) {
     for (var key in obj) {
-      if (obj.hasOwnProperty(key)) {
+      if (Object.prototype.hasOwnProperty.call(obj, key)) {
         // Regexp comes from Parse.Object.prototype.validate
         if (key !== '__type' && !/^[A-Za-z][0-9A-Za-z_]*$/.test(key)) {
           delete obj[key];

src/StatusHandler.js

@@ -148,7 +148,7 @@ export function pushStatusHandler(config, existingObjectId) {
     const now = new Date();
     let pushTime = now.toISOString();
     let status = 'pending';
-    if (body.hasOwnProperty('push_time')) {
+    if (Object.prototype.hasOwnProperty.call(body, 'push_time')) {
       if (config.hasPushScheduledSupport) {
         pushTime = body.push_time;
         status = 'scheduled';

src/cli/utils/commander.js

@@ -102,7 +102,7 @@ function parseConfigFile(program) {
 
 Command.prototype.setValuesIfNeeded = function(options) {
   Object.keys(options).forEach(key => {
-    if (!this.hasOwnProperty(key)) {
+    if (!Object.prototype.hasOwnProperty.call(this, key)) {
       this[key] = options[key];
     }
   });

src/cloud-code/Parse.Cloud.js

@@ -2,7 +2,10 @@ import { Parse } from 'parse/node';
 import * as triggers from '../triggers';
 
 function isParseObjectConstructor(object) {
-  return typeof object === 'function' && object.hasOwnProperty('className');
+  return (
+    typeof object === 'function' &&
+    Object.prototype.hasOwnProperty.call(object, 'className')
+  );
 }
 
 function getClassName(parseClass) {

src/defaults.js

@@ -19,7 +19,7 @@ const { verbose, level } = (() => {
 const DefinitionDefaults = Object.keys(ParseServerOptions).reduce(
   (memo, key) => {
     const def = ParseServerOptions[key];
-    if (def.hasOwnProperty('default')) {
+    if (Object.prototype.hasOwnProperty.call(def, 'default')) {
       memo[key] = def.default;
     }
     return memo;