LearnBoost/socket.io — Issue #684: manager.js performs unsafe iterations without hasOwnProperty
Author: Sembiance
Created: 2011-12-15 16:24:22+00:00
State: open

In several places in manager.js loops like this are performed:
for(var key in obj) {
var val = obj[key];
}

This isn't very safe as if anyone has modified the Object prototype with additional items, socket.io fails.

It's pretty standard practice to add a check:
if(!obj.hasOwnProperty(key)) { continue; }

Yes, I know that people shouldn't be modifying the Object prototype, but it does happen and socket.io should be coded robust enough to work in these situations.

I'm sure there are probably several other places in socket.io code other than manager.js where unsafe access is taking place.