{"version":3,"file":"isForbiddenKey.mjs","names":[],"sources":["../../../../../../../cache/src/drivers/isForbiddenKey.ts"],"sourcesContent":["/**\r\n * Keys that reach `Object.prototype` (or any other prototype) when they\r\n * are assigned onto a plain object, polluting every object in the\r\n * runtime.\r\n *\r\n * Cache keys are caller-controlled — and on a shared origin they are\r\n * also *storage*-controlled, since anything else running on the origin\r\n * can write a key of its choosing into localStorage or the cache\r\n * database. Any helper that turns stored keys back into object\r\n * properties has to filter these out first.\r\n */\r\nexport const FORBIDDEN_KEYS = [\"__proto__\", \"constructor\", \"prototype\"];\r\n\r\n/**\r\n * Check whether `key` is a prototype-pollution vector.\r\n *\r\n * Note that storing such a key is perfectly safe in every driver: the\r\n * runtime driver is backed by a `Map`, Web Storage keys are strings in a\r\n * separate namespace, and IndexedDB keys are structured-clone values —\r\n * none of them do prototype-chain lookups. The guard exists for the one\r\n * place where keys become object properties again: bulk reads that\r\n * return a plain `{ key: value }` record.\r\n */\r\nexport default function isForbiddenKey(key: string): boolean {\r\n  return FORBIDDEN_KEYS.includes(key);\r\n}\r\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,iBAAiB;CAAC;CAAa;CAAe;AAAW;;;;;;;;;;;AAYtE,SAAwB,eAAe,KAAsB;CAC3D,OAAO,eAAe,SAAS,GAAG;AACpC"}