Fix no-prototype-builtins rule

.eslintrc.js

@@ -41,7 +41,6 @@ module.exports = {
   rules: {
     'generator-star-spacing': 0,
     'no-console': 0,
-    'no-prototype-builtins': 0,
     'require-atomic-updates': 0,
   },
   settings: {

packages/strapi-hook-bookshelf/lib/index.js

@@ -480,7 +480,7 @@ module.exports = function(strapi) {
                     _.keyBy(
                       _.filter(definition.attributes, (value, key) => {
                         if (
-                          value.hasOwnProperty('columnName') &&
+                          Object.prototype.hasOwnProperty.call(value, 'columnName') &&
                           !_.isEmpty(value.columnName) &&
                           value.columnName !== key
                         ) {
@@ -576,9 +576,9 @@ module.exports = function(strapi) {
                             .attributes,
                           details => {
                             if (
-                              details.hasOwnProperty('model') &&
+                              Object.prototype.hasOwnProperty.call(details, 'model') &&
                               details.model === model &&
-                              details.hasOwnProperty('via') &&
+                              Object.prototype.hasOwnProperty.call(details, 'via') &&
                               details.via === name
                             ) {
                               return details;
@@ -589,9 +589,9 @@ module.exports = function(strapi) {
                           strapi.models[details.model].attributes,
                           details => {
                             if (
-                              details.hasOwnProperty('model') &&
+                              Object.prototype.hasOwnProperty.call(details, 'model') &&
                               details.model === model &&
-                              details.hasOwnProperty('via') &&
+                              Object.prototype.hasOwnProperty.call(details, 'via') &&
                               details.via === name
                             ) {
                               return details;

packages/strapi-hook-bookshelf/lib/utils/index.js

@@ -21,7 +21,7 @@ module.exports = {
     // This is not a Bookshelf collection, only the name.
     if (_.isString(collectionIdentity) && !_.isUndefined(models)) {
       const PK = _.findKey(_.get(models, collectionIdentity + '.attributes'), o => {
-        return o.hasOwnProperty('primary');
+        return Object.prototype.hasOwnProperty.call(o, 'primary');
       });
 
       if (!_.isEmpty(PK)) {

packages/strapi-middleware-views/lib/index.js

@@ -27,7 +27,7 @@ module.exports = strapi => {
       if (_.isPlainObject(views) && !_.isEmpty(views)) {
         const opts = _.clone(views);
 
-        if (opts.hasOwnProperty('default')) {
+        if (Object.prototype.hasOwnProperty.call(opts, 'default')) {
           opts.extension = opts.default;
           delete opts.default;
         }

packages/strapi-plugin-content-manager/admin/src/components/FilterOptions/InputWithAutoFocus.js

@@ -36,7 +36,7 @@ class InputWithAutoFocus extends React.Component {
     if (this.props.filterToFocus === this.props.index) {
       return new Promise(resolve => {
         setTimeout(() => {
-          if (this.inputEl.hasOwnProperty('openCalendar')) {
+          if (Object.prototype.hasOwnProperty.call(this.inputEl, 'openCalendar')) {
             this.inputEl.openCalendar();
           } else {
             this.inputEl.focus();

packages/strapi-plugin-content-manager/admin/src/containers/ListPage/index.js

@@ -141,8 +141,8 @@ export class ListPage extends React.Component {
 
     return Object.keys(attributes).filter(attr => {
       return (
-        !attributes[attr].hasOwnProperty('collection') &&
+        !Object.prototype.hasOwnProperty.call(attributes[attr], 'collection') &&
-        !attributes[attr].hasOwnProperty('model')
+        !Object.prototype.hasOwnProperty.call(attributes[attr], 'model')
       );
     });
   };

packages/strapi-plugin-content-manager/admin/src/containers/SettingPage/index.js

@@ -191,8 +191,8 @@ class SettingPage extends React.PureComponent {
       .filter(attr => {
         return (
           findIndex(this.getListDisplay(), ['name', attr]) === -1 &&
-          !attributes[attr].hasOwnProperty('collection') &&
+          !Object.prototype.hasOwnProperty.call(attributes[attr], 'collection') &&
-          !attributes[attr].hasOwnProperty('model')
+          !Object.prototype.hasOwnProperty.call(attributes[attr], 'model')
         );
       })
       .map(attr => {

packages/strapi-plugin-content-manager/config/policies/routing.js

@@ -30,8 +30,8 @@ module.exports = async (ctx, next) => {
     if (controller && action) {
       // Redirect to specific controller.
       if (
-        ctx.request.body.hasOwnProperty('fields') &&
+        Object.prototype.hasOwnProperty.call(ctx.request.body, 'fields') &&
-        ctx.request.body.hasOwnProperty('files')
+        Object.prototype.hasOwnProperty.call(ctx.request.body, 'files')
       ) {
         let { files, fields } = ctx.request.body;
 

packages/strapi-plugin-content-manager/services/ContentManager.js

@@ -72,7 +72,10 @@ module.exports = {
 
   add: async (params, values, source) => {
     // Multipart/form-data.
-    if (values.hasOwnProperty('fields') && values.hasOwnProperty('files')) {
+    if (
+      Object.prototype.hasOwnProperty.call(values, 'fields') &&
+      Object.prototype.hasOwnProperty.call(values, 'files')
+    ) {
       // Silent recursive parser.
       const parser = value => {
         try {
@@ -134,7 +137,10 @@ module.exports = {
 
   edit: async (params, values, source) => {
     // Multipart/form-data.
-    if (values.hasOwnProperty('fields') && values.hasOwnProperty('files')) {
+    if (
+      Object.prototype.hasOwnProperty.call(values, 'fields') &&
+      Object.prototype.hasOwnProperty.call(values, 'files')
+    ) {
       // Silent recursive parser.
       const parser = value => {
         try {

packages/strapi-plugin-content-type-builder/admin/src/containers/AttributesPickerModal/index.js

@@ -49,7 +49,7 @@ class AttributesPickerModal extends React.Component {
     const appPlugins = plugins;
 
     return attributes.filter(attr => {
-      if (appPlugins.hasOwnProperty('upload')) {
+      if (Object.prototype.hasOwnProperty.call(appPlugins, 'upload')) {
         return true;
       }
 

packages/strapi-plugin-documentation/services/Documentation.js

@@ -381,8 +381,8 @@ module.exports = {
       (acc, curr) => {
         const attribute = attributes[curr];
         const isField =
-          !attribute.hasOwnProperty('model') &&
+          !Object.prototype.hasOwnProperty.call(attribute, 'model') &&
-          !attribute.hasOwnProperty('collection');
+          !Object.prototype.hasOwnProperty.call(attribute, 'collection');
 
         if (attribute.required) {
           acc.required.push(curr);
@@ -1525,8 +1525,8 @@ module.exports = {
       .map(attr => {
         const attribute = modelAttributes[attr];
         const isField =
-          !attribute.hasOwnProperty('model') &&
+          !Object.prototype.hasOwnProperty.call(attribute, 'model') &&
-          !attribute.hasOwnProperty('collection');
+          !Object.prototype.hasOwnProperty.call(attribute, 'collection');
 
         if (!isField) {
           const name = attribute.model || attribute.collection;
@@ -1730,7 +1730,7 @@ module.exports = {
   mergeComponents: (initObj, srcObj) => {
     const cleanedObj = Object.keys(_.get(initObj, 'schemas', {})).reduce(
       (acc, current) => {
-        const targetObj = _.get(srcObj, ['schemas'], {}).hasOwnProperty(current)
+        const targetObj = Object.prototype.hasOwnProperty.call(_.get(srcObj, ['schemas'], {}), current)
           ? srcObj
           : initObj;
 
@@ -1750,7 +1750,7 @@ module.exports = {
 
   mergePaths: function(initObj, srcObj) {
     return Object.keys(initObj.paths).reduce((acc, current) => {
-      if (_.get(srcObj, ['paths'], {}).hasOwnProperty(current)) {
+      if (Object.prototype.hasOwnProperty.call(_.get(srcObj, ['paths'], {}), current)) {
         const verbs = Object.keys(initObj.paths[current]).reduce(
           (acc1, curr) => {
             const verb = this.mergeVerbObject(

packages/strapi-utils/lib/finder.js

@@ -15,7 +15,7 @@ module.exports = (api, controller) => {
     throw new Error('Should be an object');
   }
 
-  if (_.isObject(controller) && controller.hasOwnProperty('identity')) {
+  if (_.isObject(controller) && Object.prototype.hasOwnProperty.call(controller, 'identity')) {
     controller = controller.identity.toLowerCase();
   } else if (_.isString(controller)) {
     controller = controller.toLowerCase();

packages/strapi-utils/lib/models.js

@@ -108,8 +108,8 @@ module.exports = {
       }
 
       if (
-        (association.hasOwnProperty('collection') && association.collection === '*') ||
+        (Object.prototype.hasOwnProperty.call(association, 'collection') && association.collection === '*') ||
-        (association.hasOwnProperty('model') && association.model === '*')
+        (Object.prototype.hasOwnProperty.call(association, 'model') && association.model === '*')
       ) {
         if (association.model) {
           types.current = 'morphToD';
@@ -130,13 +130,13 @@ module.exports = {
         // We have to find if they are a model linked to this key
         _.forIn(allModels, model => {
           _.forIn(model.attributes, attribute => {
-            if (attribute.hasOwnProperty('via') && attribute.via === key && attribute.model === currentModelName) {
+            if (Object.prototype.hasOwnProperty.call(attribute, 'via') && attribute.via === key && attribute.model === currentModelName) {
-              if (attribute.hasOwnProperty('collection')) {
+              if (Object.prototype.hasOwnProperty.call(attribute, 'collection')) {
                 types.other = 'collection';
 
                 // Break loop
                 return false;
-              } else if (attribute.hasOwnProperty('model')) {
+              } else if (Object.prototype.hasOwnProperty.call(attribute, 'model')) {
                 types.other = 'model';
 
                 // Break loop
@@ -145,7 +145,7 @@ module.exports = {
             }
           });
         });
-      } else if (association.hasOwnProperty('via') && association.hasOwnProperty('collection')) {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'via') && Object.prototype.hasOwnProperty.call(association, 'collection')) {
         const relatedAttribute = models[association.collection].attributes[association.via];
 
         if (!relatedAttribute) {
@@ -159,23 +159,23 @@ module.exports = {
         types.current = 'collection';
 
         if (
-          relatedAttribute.hasOwnProperty('collection') &&
+          Object.prototype.hasOwnProperty.call(relatedAttribute, 'collection') &&
           relatedAttribute.collection !== '*' &&
-          relatedAttribute.hasOwnProperty('via')
+          Object.prototype.hasOwnProperty.call(relatedAttribute, 'via')
         ) {
           types.other = 'collection';
         } else if (
-          relatedAttribute.hasOwnProperty('collection') &&
+          Object.prototype.hasOwnProperty.call(relatedAttribute, 'collection') &&
           relatedAttribute.collection !== '*' &&
-          !relatedAttribute.hasOwnProperty('via')
+          !Object.prototype.hasOwnProperty.call(relatedAttribute, 'via')
         ) {
           types.other = 'collectionD';
-        } else if (relatedAttribute.hasOwnProperty('model') && relatedAttribute.model !== '*') {
+        } else if (Object.prototype.hasOwnProperty.call(relatedAttribute, 'model') && relatedAttribute.model !== '*') {
           types.other = 'model';
-        } else if (relatedAttribute.hasOwnProperty('collection') || relatedAttribute.hasOwnProperty('model')) {
+        } else if (Object.prototype.hasOwnProperty.call(relatedAttribute, 'collection') || Object.prototype.hasOwnProperty.call(relatedAttribute, 'model')) {
           types.other = 'morphTo';
         }
-      } else if (association.hasOwnProperty('via') && association.hasOwnProperty('model')) {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'via') && Object.prototype.hasOwnProperty.call(association, 'model')) {
         types.current = 'modelD';
 
         // We have to find if they are a model linked to this key
@@ -183,30 +183,30 @@ module.exports = {
         const attribute = model.attributes[association.via];
 
         if (
-          attribute.hasOwnProperty('via') &&
+          Object.prototype.hasOwnProperty.call(attribute, 'via') &&
           attribute.via === key &&
-          attribute.hasOwnProperty('collection') &&
+          Object.prototype.hasOwnProperty.call(attribute, 'collection') &&
           attribute.collection !== '*'
         ) {
           types.other = 'collection';
-        } else if (attribute.hasOwnProperty('model') && attribute.model !== '*') {
+        } else if (Object.prototype.hasOwnProperty.call(attribute, 'model') && attribute.model !== '*') {
           types.other = 'model';
-        } else if (attribute.hasOwnProperty('collection') || attribute.hasOwnProperty('model')) {
+        } else if (Object.prototype.hasOwnProperty.call(attribute, 'collection') || Object.prototype.hasOwnProperty.call(attribute, 'model')) {
           types.other = 'morphTo';
         }
-      } else if (association.hasOwnProperty('model')) {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'model')) {
         types.current = 'model';
 
         // We have to find if they are a model linked to this key
         _.forIn(models, model => {
           _.forIn(model.attributes, attribute => {
-            if (attribute.hasOwnProperty('via') && attribute.via === key) {
+            if (Object.prototype.hasOwnProperty.call(attribute, 'via') && attribute.via === key) {
-              if (attribute.hasOwnProperty('collection')) {
+              if (Object.prototype.hasOwnProperty.call(attribute, 'collection')) {
                 types.other = 'collection';
 
                 // Break loop
                 return false;
-              } else if (attribute.hasOwnProperty('model')) {
+              } else if (Object.prototype.hasOwnProperty.call(attribute, 'model')) {
                 types.other = 'modelD';
 
                 // Break loop
@@ -215,19 +215,19 @@ module.exports = {
             }
           });
         });
-      } else if (association.hasOwnProperty('collection')) {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'collection')) {
         types.current = 'collectionD';
 
         // We have to find if they are a model linked to this key
         _.forIn(models, model => {
           _.forIn(model.attributes, attribute => {
-            if (attribute.hasOwnProperty('via') && attribute.via === key) {
+            if (Object.prototype.hasOwnProperty.call(attribute, 'via') && attribute.via === key) {
-              if (attribute.hasOwnProperty('collection')) {
+              if (Object.prototype.hasOwnProperty.call(attribute, 'collection')) {
                 types.other = 'collection';
 
                 // Break loop
                 return false;
-              } else if (attribute.hasOwnProperty('model')) {
+              } else if (Object.prototype.hasOwnProperty.call(attribute, 'model')) {
                 types.other = 'modelD';
 
                 // Break loop
@@ -268,14 +268,14 @@ module.exports = {
           nature: 'oneMorphToOne',
           verbose: 'belongsToMorph',
         };
-      } else if (types.current === 'morphTo' && (types.other === 'model' || association.hasOwnProperty('model'))) {
+      } else if (types.current === 'morphTo' && (types.other === 'model' || Object.prototype.hasOwnProperty.call(association, 'model'))) {
         return {
           nature: 'manyMorphToOne',
           verbose: 'belongsToManyMorph',
         };
       } else if (
         types.current === 'morphTo' &&
-        (types.other === 'collection' || association.hasOwnProperty('collection'))
+        (types.other === 'collection' || Object.prototype.hasOwnProperty.call(association, 'collection'))
       ) {
         return {
           nature: 'manyMorphToMany',
@@ -383,7 +383,7 @@ module.exports = {
       }
 
       // Exclude non-relational attribute
-      if (!association.hasOwnProperty('collection') && !association.hasOwnProperty('model')) {
+      if (!Object.prototype.hasOwnProperty.call(association, 'collection') && !Object.prototype.hasOwnProperty.call(association, 'model')) {
         return undefined;
       }
 
@@ -399,7 +399,7 @@ module.exports = {
       }
 
       // Build associations object
-      if (association.hasOwnProperty('collection') && association.collection !== '*') {
+      if (Object.prototype.hasOwnProperty.call(association, 'collection') && association.collection !== '*') {
         const ast = {
           alias: key,
           type: 'collection',
@@ -417,7 +417,7 @@ module.exports = {
         }
 
         definition.associations.push(ast);
-      } else if (association.hasOwnProperty('model') && association.model !== '*') {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'model') && association.model !== '*') {
         definition.associations.push({
           alias: key,
           type: 'model',
@@ -429,7 +429,7 @@ module.exports = {
           plugin: association.plugin || undefined,
           filter: details.filter,
         });
-      } else if (association.hasOwnProperty('collection') || association.hasOwnProperty('model')) {
+      } else if (Object.prototype.hasOwnProperty.call(association, 'collection') || Object.prototype.hasOwnProperty.call(association, 'model')) {
         const pluginsModels = Object.keys(strapi.plugins).reduce((acc, current) => {
           Object.keys(strapi.plugins[current].models).forEach(entity => {
             Object.keys(strapi.plugins[current].models[entity].attributes).forEach(attribute => {
@@ -505,7 +505,7 @@ module.exports = {
       }, {}),
     );
 
-    if (!models.hasOwnProperty(model)) {
+    if (!Object.prototype.hasOwnProperty.call(models, model)) {
       return this.log.error(`The model ${model} can't be found.`);
     }
 

packages/strapi/lib/core/bootstrap.js

@@ -258,7 +258,7 @@ module.exports = function(strapi) {
       );
       acc[current] = !_.isObject(currentSettings) ? {} : currentSettings;
 
-      if (!acc[current].hasOwnProperty('enabled')) {
+      if (!Object.prototype.hasOwnProperty.call(acc[current], 'enabled')) {
         strapi.log.warn(
           `(middleware:${current}) wasn't loaded due to missing key \`enabled\` in the configuration`
         );
@@ -284,7 +284,7 @@ module.exports = function(strapi) {
 
       acc[current] = !_.isObject(currentSettings) ? {} : currentSettings;
 
-      if (!acc[current].hasOwnProperty('enabled')) {
+      if (!Object.prototype.hasOwnProperty.call(acc[current], 'enabled')) {
         strapi.log.warn(
           `(hook:${current}) wasn't loaded due to missing key \`enabled\` in the configuration`
         );

packages/strapi/lib/middlewares/router/index.js

@@ -56,7 +56,7 @@ module.exports = strapi => {
           // Exclude routes with prefix.
           const excludedRoutes = _.omitBy(
             plugin.config.routes,
-            o => !o.config.hasOwnProperty('prefix')
+            o => !Object.prototype.hasOwnProperty.call(o.config, 'prefix')
           );
 
           _.forEach(

packages/strapi/lib/middlewares/session/index.js

@@ -24,7 +24,7 @@ module.exports = strapi => {
         strapi.config.hooks.session.secretKeys;
 
       if (
-        strapi.config.middleware.settings.session.hasOwnProperty('client') &&
+        Object.prototype.hasOwnProperty.call(strapi.config.middleware.settings.session, 'client') &&
         _.isString(strapi.config.middleware.settings.session.client) &&
         strapi.config.middleware.settings.session.client !== 'cookie'
       ) {
@@ -52,7 +52,7 @@ module.exports = strapi => {
           });
         }
       } else if (
-        strapi.config.middleware.settings.session.hasOwnProperty('client') &&
+        Object.prototype.hasOwnProperty.call(strapi.config.middleware.settings.session, 'client') &&
         _.isString(strapi.config.middleware.settings.session.client) &&
         strapi.config.middleware.settings.session.client === 'cookie'
       ) {