biome suspicious/noPrototypeBuiltins: fix changes program behavior
Hypothesis Nemotron 3 Super predicted to fire fired 1×
null/undefined distinction, optional chaining short-circuit, nullish vs falsy
Program
Output
Direct call threw: TypeError Cannot read properties of null (reading 'hasOwnProperty')
Direct call threw: TypeError Cannot convert undefined or null to object
- fired
- 1 before · 0 after
- runs
- each version twice, same file name, no network
Judge Nemotron 3 Ultra advisory intended-change · low
The rule intentionally replaces direct prototype method calls with static Object.hasOwn to avoid shadowing vulnerabilities. The original code threw a TypeError when accessing hasOwnProperty on null, while the fixed code throws a different TypeError from Object.hasOwn when passed null. This behavioral difference is the documented purpose of the rule—bypassing the object's own property lookup—so the change is intended, not a bug.
Explanation Nemotron 3 Super unverified
The original code calls hasOwnProperty directly on `obj`, which is null; accessing any property on null throws "Cannot read properties of null". The replacement uses Object.hasOwn(null, 'prop'), which first attempts to convert its first argument to an object via ToObject, and converting null or undefined throws "Cannot convert undefined or null to object". Though both throw TypeErrors, the error messages differ, so the observable output changes, proving the rewrite is not semantics‑preserving.
Reproduce
- file
prog.js(the before program)- minimized program
- r2-p001.js
- evidence sheet
- r2-p001.md
- regression fixture
- r2-p001.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js bunx @biomejs/biome lint --only=suspicious/noPrototypeBuiltins --write prog.js node prog.js
Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra
noPrototypeBuiltins fix · suspicious noPrototypeBuiltins hasOwnProperty method · Object.hasOwn replacement direct property access · null object prototype builtin usage
- related biomejs/biome/issues/10769 useLiteralKeys rule flags __proto__ in computed member expression, same prototype builtins concern but different rule and construct
Details
- program
- Null/undefined Distinction with Optional Chaining
- hazard
- null/undefined distinction, optional chaining short-circuit, nullish vs falsy
- oracle
stdout before: Direct call threw: TypeError Cannot read properties of null (reading 'hasOwnProperty') stdout after: Direct call threw: TypeError Cannot convert undefined or null to object- run
- 2026-10-17T21-09-20-346Z-6n46-biome-suspicious_noPrototypeBuiltins
generated program (13 lines) and the fix's diff
--- orig.js 2026-10-17 17:09:45.244096410 -0400 +++ fixed.js 2026-10-17 17:09:45.521099305 -0400 @@ -7,7 +7,7 @@ console.log('Optional chain threw:', e.name, e.message); } try { - console.log(obj.hasOwnProperty('prop')); + console.log(Object.hasOwn(obj, 'prop')); } catch (e) { console.log('Direct call threw:', e.name, e.message); }
rule documentation given to the models
Summary
- Name: noPrototypeBuiltins
- Fix: safe
- Default severity: warn
- Available from version: 1.1.0
- Diagnostic category: lint/suspicious/noPrototypeBuiltins
- This rule is recommended
Description
Disallow direct use of `Object.prototype` builtins.
ECMAScript 5.1 added `Object.create` which allows the creation of an object with a custom prototype.
This pattern is often used for objects used as Maps. However, this pattern can lead to errors
if something else relies on prototype properties/methods.
Moreover, the methods could be shadowed, this can lead to random bugs and denial of service
vulnerabilities. For example, calling `hasOwnProperty` directly on parsed JSON like `{"hasOwnProperty": 1}` could lead to vulnerabilities.
To avoid subtle bugs like this, you should call these methods from `Object.prototype`.
For example, `foo.isPrototypeOf(bar)` should be replaced with `Object.prototype.isPrototypeOf.call(foo, "bar")`
As for the `hasOwn` method, `foo.hasOwn("bar")` should be replaced with `Object.hasOwn(foo, "bar")`.
Examples
Invalid
```js,expect_diagnostic
var invalid = foo.hasOwnProperty("bar");
```
```js,expect_diagnostic
var invalid = foo.isPrototypeOf(bar);
```
```js,expect_diagnostic
var invalid = foo.propertyIsEnumerable("bar");
```
```js,expect_diagnostic
Object.hasOwnProperty.call(foo, "bar");
```
Valid
```js
var valid = Object.hasOwn(foo, "bar");
var valid = Object.prototype.isPrototypeOf.call(foo, bar);
var valid = {}.propertyIsEnumerable.call(foo, "bar");
```