Skip to content

fix(table-core): prototype-named column ids poisoning row value caches#6337

Open
artchen-db wants to merge 1 commit into
TanStack:mainfrom
artchen-db:hasownproperty-fix
Open

fix(table-core): prototype-named column ids poisoning row value caches#6337
artchen-db wants to merge 1 commit into
TanStack:mainfrom
artchen-db:hasownproperty-fix

Conversation

@artchen-db

Copy link
Copy Markdown

🎯 Changes

A column whose id equals an Object.prototype member (most impactfully hasOwnProperty) crashes filtering/sorting:

TypeError: this._valuesCache.hasOwnProperty is not a function

Root cause: the per-row value caches are plain {} objects probed with cache.hasOwnProperty(columnId), then written keyed by column id. When columnId === "hasOwnProperty", the write shadows the inherited method, so the next probe invokes a cached value as a function and throws — breaking filtering for every column on that row, and sorting on the offending column.

Fix: initialize the caches (_valuesCache, _uniqueValuesCache, _groupingValuesCache) with Object.create(null) and read them via Object.prototype.hasOwnProperty.call(...). Also null-prototype _getAllCellsByColumnId so ids like toString/constructor resolve correctly when read via bracket access in getColumnCanGlobalFilter. This removes the entire prototype-collision class for these caches.

Added tests/prototypeColumnId.test.ts covering getValue, getUniqueValues, and the cascading-failure case across hasOwnProperty, toString, constructor, valueOf, __proto__, isPrototypeOf. The test fails without the fix and passes with it.

✅ Checklist

  • I have followed the steps in the Contributing guide.
  • I have tested this code locally with pnpm test:pr.

🚀 Release Impact

  • This change affects published code, and I have generated a changeset.
  • This change is docs/CI/dev-only (no release).

Row value caches (_valuesCache, _uniqueValuesCache, _groupingValuesCache)
were plain objects probed with cache.hasOwnProperty(columnId). A column
whose id collided with an Object.prototype member (e.g. hasOwnProperty)
shadowed the inherited method on write, so the next probe invoked a cached
value as a function and threw TypeError, crashing filtering and sorting.

Caches are now created with Object.create(null) and read via
Object.prototype.hasOwnProperty.call. _getAllCellsByColumnId is likewise
null-prototyped so prototype-named ids resolve correctly when read via
bracket access in getColumnCanGlobalFilter.

Co-authored-by: Isaac
@coderabbitai

coderabbitai Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fa0c421d-2860-42c0-85e0-3e0e35a0a43e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant