Repository: sequelize/sequelize
File: packages/core/test/unit/utils/undot.test.ts (TypeScript)

Code before:
        expect(() => precompileKeys(['__proto__'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on constructor as a single-segment key', () => {
        expect(() => precompileKeys(['constructor'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on prototype as a single-segment key', () => {
        expect(() => precompileKeys(['prototype'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on __proto__ in dotted key', () => {
        expect(() => precompileKeys(['a.__proto__.polluted'])).to.throw(
          'Prototype pollution attempt',
        );
      });
    });

    describe('transformRowWithPrecompiled', () => {
      it('should block __proto__ in transform keys at second position', () => {
        const pre = precompileKeys(['user.name']);
        const row: Record<string, unknown> = { 'user.name': 'guest' };
        const result = transformRowWithPrecompiled(row, pre);
        expect(result.user).to.deep.equal({ name: 'guest' });
        // @ts-expect-error -- testing pollution
        expect(({}).isAdmin).to.equal(undefined);
      });

      it('should transform normal dotted keys correctly', () => {
        const pre = precompileKeys([
          'user.name',
          'user.email',
          'user.settings.theme',
        ]);
        const row = {
          'user.name': 'Alice',
          'user.email': 'alice@example.com',
          'user.settings.theme': 'dark',
        };
        const result = transformRowWithPrecompiled(row, pre);
        expect((result as any).user.name).to.equal('Alice');
        expect((result as any).user.email).to.equal('alice@example.com');
        expect((result as any).user.settings.theme).to.equal('dark');
      });
    });
  });

  describe('edge cases and error handling', () => {
    it('setByPathArray sets value at numeric path segment on existing object (uses numeric key)', () => {
      // When the target at a numeric segment is an object (not array), it doesn't replace it.
      // Instead, the numeric segment becomes a key on the existing object.

Review comment (suggestion):
This test case name says it covers blocking `__proto__`, but the inputs only use the safe key `user.name`, so it can't actually exercise the prototype-pollution guard. To validate the behavior, craft a `PrecompiledTransform` (or row + keys) that would attempt to write through a `__proto__` segment and assert both that the result is correct for safe keys and that `Object.prototype` remains unmodified.
```suggestion
        const originalIsAdmin = ({} as any).isAdmin;
        const pre = precompileKeys(['user.name']);
        const row: Record<string, unknown> = {
          'user.name': 'guest',
          '__proto__.isAdmin': true,
        };
        const result = transformRowWithPrecompiled(row, pre);
        expect(result.user).to.deep.equal({ name: 'guest' });
        expect(({} as any).isAdmin).to.equal(originalIsAdmin);
```

Code after:
        expect(() => precompileKeys(['__proto__'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on constructor as a single-segment key', () => {
        expect(() => precompileKeys(['constructor'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on prototype as a single-segment key', () => {
        expect(() => precompileKeys(['prototype'])).to.throw('Prototype pollution attempt');
      });

      it('should throw on __proto__ in dotted key', () => {
        expect(() => precompileKeys(['a.__proto__.polluted'])).to.throw(
          'Prototype pollution attempt',
        );
      });
    });

    describe('transformRowWithPrecompiled', () => {
      it('should block __proto__ at second position via precompileKeys', () => {
        expect(() => {
          const pre = precompileKeys(['user.__proto__.isAdmin']);
          transformRowWithPrecompiled({ 'user.__proto__.isAdmin': true }, pre);
        }).to.throw('Prototype pollution attempt');
        // @ts-expect-error -- testing pollution
        expect({}.isAdmin).to.equal(undefined);
      });

      it('should block __proto__ at first position via precompileKeys', () => {
        expect(() => {
          const pre = precompileKeys(['__proto__.polluted']);
          transformRowWithPrecompiled({ '__proto__.polluted': true }, pre);
        }).to.throw('Prototype pollution attempt');
        // @ts-expect-error -- testing pollution
        expect({}.polluted).to.equal(undefined);
      });

      it('should block constructor.prototype via precompileKeys', () => {
        expect(() => {
          const pre = precompileKeys(['a.constructor.prototype.polluted']);
          transformRowWithPrecompiled({ 'a.constructor.prototype.polluted': true }, pre);
        }).to.throw('Prototype pollution attempt');
        // @ts-expect-error -- testing pollution
        expect({}.polluted).to.equal(undefined);
      });

      it('should transform normal dotted keys without pollution', () => {
        const pre = precompileKeys(['user.name', 'user.email', 'user.settings.theme']);
        const row = {
          'user.name': 'Alice',
          'user.email': 'alice@example.com',