{"action":"created","issue":{"url":"https://api.github.com/repos/petreboy14/express-joi/issues/11","labels_url":"https://api.github.com/repos/petreboy14/express-joi/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/petreboy14/express-joi/issues/11/comments","events_url":"https://api.github.com/repos/petreboy14/express-joi/issues/11/events","html_url":"https://github.com/petreboy14/express-joi/pull/11","id":96662324,"number":11,"title":"work with prototype-less objects","user":{"login":"LinusU","id":189580,"avatar_url":"https://avatars.githubusercontent.com/u/189580?v=3","gravatar_id":"","url":"https://api.github.com/users/LinusU","html_url":"https://github.com/LinusU","followers_url":"https://api.github.com/users/LinusU/followers","following_url":"https://api.github.com/users/LinusU/following{/other_user}","gists_url":"https://api.github.com/users/LinusU/gists{/gist_id}","starred_url":"https://api.github.com/users/LinusU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LinusU/subscriptions","organizations_url":"https://api.github.com/users/LinusU/orgs","repos_url":"https://api.github.com/users/LinusU/repos","events_url":"https://api.github.com/users/LinusU/events{/privacy}","received_events_url":"https://api.github.com/users/LinusU/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-22T20:58:58Z","updated_at":"2015-08-14T21:04:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/petreboy14/express-joi/pulls/11","html_url":"https://github.com/petreboy14/express-joi/pull/11","diff_url":"https://github.com/petreboy14/express-joi/pull/11.diff","patch_url":"https://github.com/petreboy14/express-joi/pull/11.patch"},"body":"I first reported this at  but it turns out that the bug was in this library.\r\n\r\n> Since the data validated by this library often is user provided input, I think we should consider it \"unsafe\". Instead of using `hasOwnProperty` directly on input objects, I think it would be better to make sure that we are actually using the builtin method `hasOwnProperty` instead of the one on the provided object.\r\n\r\n> This simple input from the user currently causes an error: `{ hasOwnProperty: 'hello' }`.\r\n\r\n> This could be fixed by changing the use of hasOwnProperty to use an already defined function. E.g.\r\n\r\n> ```javascript\r\nfunction hasOwnProperty (obj, prop) {\r\n  return Object.prototype.hasOwnProperty.call(obj, prop)\r\n}\r\n\r\n> // Instead of this:\r\ninput.hasOwnProperty(schema.key)\r\n\r\n> // We us this:\r\nhasOwnProperty(input, schema.key)\r\n```\r\n\r\n> This would also have the benefit of being able to validate objects without a prototype (e.g. created by `Object.create(null)`). This objects are usually used when you want to use a hash map, which I also think that the input to this library usually is.\r\n\r\n> You can read more on why you shouldn't use a normal js object as a hash map here: [Blog post by Guillermo Rauch](http://www.devthought.com/2012/01/18/an-object-is-not-a-hash/), [Article on 2ality](http://www.2ality.com/2012/01/objects-as-maps.html)\r\n\r\n> In `multer`, an express middleware for accepting multipart forms, we provide the data with an prototype-less object. This lead one of our users to report expressjs/multer#171 to us, which would be solved by this.\r\n\r\nThis patch fixes that and adds a test for it."},"comment":{"url":"https://api.github.com/repos/petreboy14/express-joi/issues/comments/131238783","html_url":"https://github.com/petreboy14/express-joi/pull/11#issuecomment-131238783","issue_url":"https://api.github.com/repos/petreboy14/express-joi/issues/11","id":131238783,"user":{"login":"LinusU","id":189580,"avatar_url":"https://avatars.githubusercontent.com/u/189580?v=3","gravatar_id":"","url":"https://api.github.com/users/LinusU","html_url":"https://github.com/LinusU","followers_url":"https://api.github.com/users/LinusU/followers","following_url":"https://api.github.com/users/LinusU/following{/other_user}","gists_url":"https://api.github.com/users/LinusU/gists{/gist_id}","starred_url":"https://api.github.com/users/LinusU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LinusU/subscriptions","organizations_url":"https://api.github.com/users/LinusU/orgs","repos_url":"https://api.github.com/users/LinusU/repos","events_url":"https://api.github.com/users/LinusU/events{/privacy}","received_events_url":"https://api.github.com/users/LinusU/received_events","type":"User","site_admin":false},"created_at":"2015-08-14T21:04:01Z","updated_at":"2015-08-14T21:04:01Z","body":"@petreboy14 Your build is failing because 0.6 and 0.8 ships with an older version of `npm`, this pull request is not responsible for that. I would love it if this could get merged :+1: "}}