🔧 fix: #1416 check if object is frozen before merging, add try-catch to prevent crash

Author: SaltyAom

CHANGELOG.md

@@ -4,6 +4,7 @@ Improvement:
 - coerce union status value and return type
 - add `BunHTMLBundleLike` to Elysia inline handler
 - prevent Elysia from being a dependency of itself
+- [#1416](https://github.com/elysiajs/elysia/issues/1416) check if object is frozen before merging, add try-catch to prevent crash
 - [#1419](https://github.com/elysiajs/elysia/issues/1419) guard doesn't apply scoped/global schema to object macro
 - [#1425](https://github.com/elysiajs/elysia/issues/1425) DELETE doesn't ihnerit derive/resolve type
 

example/a.ts

@@ -1,56 +1,5 @@
 import { Elysia, t } from '../src'
-import { openapi } from '@elysiajs/openapi'
 
-const macroMiddleware1 = new Elysia({ name: 'my-middleware-1' })
-	.guard({
-		as: 'scoped',
-		headers: t.Object({
-			role: t.UnionEnum(['admin', 'user'])
-		}),
-		body: t.Object({
-			foo: t.String()
-		})
-	})
-	.macro({
-		auth: {
-			resolve: ({
-				headers, // Record<string, string | undefined> <------- ERROR IS HERE - should be typed
-				body // unknown <------- ERROR IS HERE - should be typed
-			}) => {
-				console.log('headers and body are still validated at runtime!')
-				console.log(headers, body) // will not allow e.g. headers: { foo: 123 }
-			}
-		}
-	})
-
-const macroMiddleware2 = new Elysia({ name: 'my-middleware-2' })
-	.guard({
-		as: 'scoped',
-		headers: t.Object({
-			role: t.UnionEnum(['admin', 'user'])
-		}),
-		body: t.Object({
-			foo: t.String()
-		})
-	})
-	.macro('auth', {
-		resolve: ({
-			headers, // { role: "admin" | "user" } <------- no error
-			body // { foo: string } <------- no error
-		}) => {
-			console.log('headers and body are still validated at runtime!')
-			console.log(headers, body) // will not allow e.g. headers: { foo: 123 }
-		}
-	})
-
-const app1 = new Elysia()
-	.use(macroMiddleware1)
-	.post('/', () => 'Hello World 1', {
-		auth: true
-	})
-
-const app2 = new Elysia()
-	.use(macroMiddleware2)
-	.post('/', () => 'Hello World 2', {
-		auth: true
-	})
+new Elysia()
+  .decorate("db", Object.freeze({ hello: "world" }))
+  .guard({}, app => app)

src/utils.ts

@@ -81,17 +81,22 @@ export const mergeDeep = <
 		}
 
 		if (!isObject(value) || !(key in target) || isClass(value)) {
-			if (override || !(key in target))
-				target[key as keyof typeof target] = value
+			if ((override || !(key in target)) && !Object.isFrozen(target))
+				try {
+					target[key as keyof typeof target] = value
+				} catch {}
 
 			continue
 		}
 
-		target[key as keyof typeof target] = mergeDeep(
-			(target as any)[key] as any,
-			value,
-			{ skipKeys, override, mergeArray }
-		)
+		if (!Object.isFrozen(target[key]))
+			try {
+				target[key as keyof typeof target] = mergeDeep(
+					(target as any)[key] as any,
+					value,
+					{ skipKeys, override, mergeArray }
+				)
+			} catch {}
 	}
 
 	return target as A & B

test/a.test.ts

@@ -80,4 +80,10 @@ describe('mergeDeep', () => {
 
 		expect(response).toBe('ok')
 	})
+
+	it('handle freezed object', () => {
+		new Elysia()
+			.decorate('db', Object.freeze({ hello: 'world' }))
+			.guard({}, (app) => app)
+	})
 })