Merge commit from fork

Author: dinwwwh

packages/client/src/adapters/standard/rpc-json-serializer.test.ts

@@ -157,4 +157,32 @@ describe('standardRPCJsonSerializer: custom serializers', () => {
       })
     }).toThrow('Custom serializer type must be unique.')
   })
+
+  it.each(['nonExist', '__proto__', 'constructor'])('should throw when accessing non-existent path during deserialization: %s', (segment) => {
+    const serializer = new StandardRPCJsonSerializer()
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [[1, segment]]),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [[1, 'a', segment]]),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [[1, segment, 'role']]),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [], [[segment]], () => new Blob([])),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [], [['a', segment]], () => new Blob([])),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+
+    expect(
+      () => serializer.deserialize({ a: 1 }, [], [[segment, 'role']], () => new Blob([])),
+    ).toThrow(`Security error: accessing non-existent path during deserialization. Path segment: ${segment}`)
+  })
 })

packages/client/src/adapters/standard/rpc-json-serializer.ts

@@ -145,6 +145,10 @@ export class StandardRPCJsonSerializer {
         segments.forEach((segment) => {
           currentRef = currentRef[preSegment]
           preSegment = segment
+
+          if (!Object.hasOwn(currentRef, preSegment)) {
+            throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`)
+          }
         })
 
         currentRef[preSegment] = getBlob(i)
@@ -160,6 +164,10 @@ export class StandardRPCJsonSerializer {
       for (let i = 1; i < item.length; i++) {
         currentRef = currentRef[preSegment]
         preSegment = item[i]!
+
+        if (!Object.hasOwn(currentRef, preSegment)) {
+          throw new Error(`Security error: accessing non-existent path during deserialization. Path segment: ${preSegment}`)
+        }
       }
 
       for (const custom of this.customSerializers) {