[Fix] avoid being fooled by a Symbol.toStringTag

ljharb · ljharb · commit fa5870da468a · 2025-02-04T16:36:44.000-08:00
diff --git a/index.js b/index.js
@@ -287,13 +287,16 @@ function quote(s) {
     return $replace.call(String(s), /"/g, '&quot;');
 }
 
-function isArray(obj) { return toStr(obj) === '[object Array]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isDate(obj) { return toStr(obj) === '[object Date]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isRegExp(obj) { return toStr(obj) === '[object RegExp]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isError(obj) { return toStr(obj) === '[object Error]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isString(obj) { return toStr(obj) === '[object String]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isNumber(obj) { return toStr(obj) === '[object Number]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
-function isBoolean(obj) { return toStr(obj) === '[object Boolean]' && (!toStringTag || !(typeof obj === 'object' && toStringTag in obj)); }
+function canTrustToString(obj) {
+    return !toStringTag || !(typeof obj === 'object' && (toStringTag in obj || typeof obj[toStringTag] !== 'undefined'));
+}
+function isArray(obj) { return toStr(obj) === '[object Array]' && canTrustToString(obj); }
+function isDate(obj) { return toStr(obj) === '[object Date]' && canTrustToString(obj); }
+function isRegExp(obj) { return toStr(obj) === '[object RegExp]' && canTrustToString(obj); }
+function isError(obj) { return toStr(obj) === '[object Error]' && canTrustToString(obj); }
+function isString(obj) { return toStr(obj) === '[object String]' && canTrustToString(obj); }
+function isNumber(obj) { return toStr(obj) === '[object Number]' && canTrustToString(obj); }
+function isBoolean(obj) { return toStr(obj) === '[object Boolean]' && canTrustToString(obj); }
 
 // Symbol and BigInt do have Symbol.toStringTag by spec, so that can't be used to eliminate false positives
 function isSymbol(obj) {
diff --git a/test/values.js b/test/values.js
@@ -5,6 +5,7 @@ var test = require('tape');
 var mockProperty = require('mock-property');
 var hasSymbols = require('has-symbols/shams')();
 var hasToStringTag = require('has-tostringtag/shams')();
+var forEach = require('for-each');
 
 test('values', function (t) {
     t.plan(1);
@@ -209,3 +210,48 @@ test('RegExps', function (t) {
 
     t.end();
 });
+
+test('Proxies', { skip: typeof Proxy !== 'function' || !hasToStringTag }, function (t) {
+    var target = { proxy: true };
+    var fake = new Proxy(target, { has: function () { return false; } });
+
+    forEach([
+        'Boolean',
+        'Number',
+        'String',
+        'Symbol',
+        'Date'
+    ], function (tag) {
+        target[Symbol.toStringTag] = tag;
+
+        t.equal(
+            inspect(fake),
+            '{ proxy: true, [Symbol(Symbol.toStringTag)]: \'' + tag + '\' }',
+            'Proxy for + ' + tag + ' shows as the target, which has no slots'
+        );
+    });
+
+    t.end();
+});
+
+test('fakers', { skip: !hasToStringTag }, function (t) {
+    var target = { proxy: false };
+
+    forEach([
+        'Boolean',
+        'Number',
+        'String',
+        'Symbol',
+        'Date'
+    ], function (tag) {
+        target[Symbol.toStringTag] = tag;
+
+        t.equal(
+            inspect(target),
+            '{ proxy: false, [Symbol(Symbol.toStringTag)]: \'' + tag + '\' }',
+            'Object pretending to be ' + tag + ' does not trick us'
+        );
+    });
+
+    t.end();
+});
