Object.prototype conflict with sharp module!

[observ33r]

Sample code:

import Sharp from 'sharp';

Object.prototype.testProtoFunc = function () {
	//code
	return this;
};

const { data, info } = await Sharp('./image.png').raw().toBuffer({
	resolveWithObject: true
});

Output:

/home/user/node/node_modules/sharp/lib/output.js:1187
        sharp.pipeline(this.options, (err, data, info) => {
              ^

TypeError: A string was expected
    at /home/user/node/node_modules/sharp/lib/output.js:1187:15
    at new Promise (<anonymous>)
    at Sharp._pipeline (/home/user/node/node_modules/sharp/lib/output.js:1186:14)
    at Sharp.toBuffer (/home/user/node/node_modules/sharp/lib/output.js:146:15)
    at file:///home/user/node/src/base16.js:8:60
    at ModuleJob.run (node:internal/modules/esm/module_job:198:25)
    at async Promise.all (index 0)
    at async ESMLoader.import (node:internal/modules/esm/loader:409:24)
    at async loadESM (node:internal/process/esm_loader:85:5)
    at async handleMainPromise (node:internal/modules/run_main:61:12)

Node.js v18.5.0
sharp 0.30.7

This is definitely not expected behavior for module!

[lovell]

The problem occurs here when parsing an Object containing EXIF metadata:

https://github.com/lovell/sharp/blob/e40a881ab4a5e7b0e37ba17e31b3b186aef8cbf6/src/pipeline.cc#L1496-L1500

The existing logic uses GetPropertyNames but doesn't filter these to ensure they are "owned" by the object, thus will also try to use any properties inherited from the Object prototype.

Commit https://github.com/lovell/sharp/commit/c295f06a6f60daf93d9b793dd5f7664ff559b1cf wraps this logic in a HasOwnProperty check. This will be in v0.31.0, thanks for reporting.

[lovell]

Re-opening until the fix is published (to allow discoverability for others who might run into the same problem).

[lovell]

v0.31.0 now available, thanks for reporting.