biome suspicious/noPrototypeBuiltins: fix changes program behavior

Hypothesis Nemotron 3 Super predicted to fire fired 1×

If foo.hasOwnProperty is a non-function value (e.g., a number or string), the original code throws TypeError when invoked, but the fix attempts to call Object.prototype.hasOwnProperty.call which expec

Program

Output

(no stdout)

false

Judge Nemotron 3 Ultra advisory intended-change · high

The program deliberately shadows hasOwnProperty on obj with a non-function value (42). The rule exists precisely to bypass such shadowing by rewriting obj.hasOwnProperty('x') to Object.hasOwn(obj, 'x'). Before the fix the call throws a TypeError (caught silently, no output); after the fix Object.hasOwn correctly returns false, which is printed. This behavioral change is the documented purpose of the rule, not a bug in the fix.

Explanation Nemotron 3 Super unverified

The original call uses `obj.hasOwnProperty`, which accesses the overridden property defined on `obj` that returns the number 42, so `console.log(42)` outputs `42`. The fix replaces it with `Object.hasOwn(obj, 'x')`, which calls the built-in method unaffected by the override, correctly returning `false` since `obj` has no own property `'x'`. Thus, the behavior changes from logging `42` to logging `false`.

Reproduce

file

prog.js (the before program)

minimized program

r1-p007.js

evidence sheet

r1-p007.md

regression fixture

r1-p007.js the minimized program with a header stating the observed change, for the tool's test suite

node prog.js
bunx @biomejs/biome lint --only=suspicious/noPrototypeBuiltins --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

noPrototypeBuiltins fix · suspicious noPrototypeBuiltins hasOwnProperty call · suspicious noPrototypeBuiltins object method override · suspicious noPrototypeBuiltins prototype property shadowing

• related biomejs/biome/issues/10769 useLiteralKeys flags __proto__ in computed member expression with unsafe fix conflicting with noProto, same rule family (prototype builtins) but different construct

Details

program

Non-Function hasOwnProperty Value

hazard

If foo.hasOwnProperty is a non-function value (e.g., a number or string), the original code throws TypeError when invoked, but the fix attempts to call Object.prototype.hasOwnProperty.call which expec

oracle

stdout before: stdout after: false

run

2026-10-17T21-09-20-346Z-6n46-biome-suspicious_noPrototypeBuiltins

--- orig.js	2026-10-17 17:09:36.086000620 -0400
+++ fixed.js	2026-10-17 17:09:36.357003457 -0400
@@ -1,12 +1,12 @@
 const obj = {};
 Object.defineProperty(obj, 'hasOwnProperty', { value: 42, writable: false });
 try {
-  console.log(obj.hasOwnProperty('x'));
+  console.log(Object.hasOwn(obj, 'x'));
 } catch (e) {
   console.log(e.name, e.message);
 }
 try {
-  console.log(Object.prototype.hasOwnProperty.call(obj, 'x'));
+  console.log(Object.hasOwn(obj, 'x'));
 } catch (e) {
   console.log(e.name, e.message);
 }

Summary

- Name: noPrototypeBuiltins
- Fix: safe
- Default severity: warn
- Available from version: 1.1.0
- Diagnostic category: lint/suspicious/noPrototypeBuiltins
- This rule is recommended

Description

 Disallow direct use of `Object.prototype` builtins.

 ECMAScript 5.1 added `Object.create` which allows the creation of an object with a custom prototype.
 This pattern is often used for objects used as Maps. However, this pattern can lead to errors
 if something else relies on prototype properties/methods.
 Moreover, the methods could be shadowed, this can lead to random bugs and denial of service
 vulnerabilities. For example, calling `hasOwnProperty` directly on parsed JSON like `{"hasOwnProperty": 1}` could lead to vulnerabilities.
 To avoid subtle bugs like this, you should call these methods from `Object.prototype`.
 For example, `foo.isPrototypeOf(bar)` should be replaced with `Object.prototype.isPrototypeOf.call(foo, "bar")`
 As for the `hasOwn` method, `foo.hasOwn("bar")` should be replaced with `Object.hasOwn(foo, "bar")`.

Examples

Invalid

 ```js,expect_diagnostic
 var invalid = foo.hasOwnProperty("bar");
 ```

 ```js,expect_diagnostic
 var invalid = foo.isPrototypeOf(bar);
 ```

 ```js,expect_diagnostic
 var invalid = foo.propertyIsEnumerable("bar");
 ```

 ```js,expect_diagnostic
 Object.hasOwnProperty.call(foo, "bar");
 ```

Valid

 ```js
 var valid = Object.hasOwn(foo, "bar");
 var valid = Object.prototype.isPrototypeOf.call(foo, bar);
 var valid = {}.propertyIsEnumerable.call(foo, "bar");
 ```