Chart operation prototype protection (#2569)

src/core/lib/Charts.mjs

@@ -153,7 +153,7 @@ export function getSeriesValues(input, recordDelimiter, fieldDelimiter, columnHe
     );
 
     let xValues = new Set();
-    const series = {};
+    const series = Object.create(null);
 
     values.forEach(row => {
         const serie = row[0],
@@ -163,14 +163,14 @@ export function getSeriesValues(input, recordDelimiter, fieldDelimiter, columnHe
         if (Number.isNaN(val)) throw new OperationError("Values must be numbers in base 10.");
 
         xValues.add(xVal);
-        if (typeof series[serie] === "undefined") series[serie] = {};
+        if (typeof series[serie] === "undefined") series[serie] = Object.create(null);
         series[serie][xVal] = val;
     });
 
     xValues = new Array(...xValues);
 
     const seriesList = [];
-    for (const seriesName in series) {
+    for (const seriesName of Object.keys(series)) {
         const serie = series[seriesName];
         seriesList.push({name: seriesName, data: serie});
     }

src/core/lib/Protocol.mjs

@@ -8,6 +8,7 @@
 
 import BigNumber from "bignumber.js";
 import {toHexFast} from "../lib/Hex.mjs";
+import Utils from "../Utils.mjs";
 
 /**
  * Recursively displays a JSON object as an HTML table
@@ -25,15 +26,16 @@ export function objToTable(obj, nested=false) {
             <th>Value</th>
         </tr>`;
 
-    for (const key in obj) {
-        if (typeof obj[key] === "function")
+    for (const key of Object.keys(obj)) {
+        const value = obj[key];
+        if (typeof value === "function")
             continue;
 
-        html += `<tr><td style='word-wrap: break-word'>${key}</td>`;
-        if (typeof obj[key] === "object")
-            html += `<td style='padding: 0'>${objToTable(obj[key], true)}</td>`;
+        html += `<tr><td style='word-wrap: break-word'>${Utils.escapeHtml(String(key))}</td>`;
+        if (value !== null && typeof value === "object")
+            html += `<td style='padding: 0'>${objToTable(value, true)}</td>`;
         else
-            html += `<td>${obj[key]}</td>`;
+            html += `<td>${Utils.escapeHtml(String(value))}</td>`;
         html += "</tr>";
     }
     html += "</table>";