LearnNewsExamplesServices
Frontmatter
id8816
titleFix Prototype Pollution in Unit Tests by Assigning Neo.setupClass
stateClosed
labels
bugtestingcore
assigneestobiu
createdAtJan 19, 2026, 6:29 PM
updatedAtJan 19, 2026, 6:30 PM
githubUrlhttps://github.com/neomjs/neo/issues/8816
authortobiu
commentsCount1
parentIssuenull
subIssues[]
subIssuesCompleted0
subIssuesTotal0
blockedBy[]
blocking[]
closedAtJan 19, 2026, 6:30 PM

Fix Prototype Pollution in Unit Tests by Assigning Neo.setupClass

Closed v11.23.0 bugtestingcore
tobiu
tobiu commented on Jan 19, 2026, 6:29 PM

Multiple unit tests were calling Neo.setupClass(Class) without assigning the result back to the class variable. This causes prototype pollution because the original class constructor is modified in place (or its prototype is), but the enhanced class (returned by setupClass) is not used. This leads to unpredictable test interactions and failures, particularly TypeError: Neo.setupClass is not a function when subsequent tests rely on a clean state or when the class system enhancement logic is bypassed.

This fix applies the pattern Class = Neo.setupClass(Class) to all affected unit tests.

tobiu added the bug label on Jan 19, 2026, 6:29 PM
tobiu added the testing label on Jan 19, 2026, 6:29 PM
tobiu added the core label on Jan 19, 2026, 6:29 PM
tobiu referenced in commit 24a9051 - "fix: Prevent prototype pollution in unit tests by assigning Neo.setupClass result (#8816)" on Jan 19, 2026, 6:30 PM
tobiu assigned to @tobiu on Jan 19, 2026, 6:30 PM
tobiu
tobiu Jan 19, 2026, 6:30 PM

Input from Gemini 3 Pro:

✦ I have applied the Class = Neo.setupClass(Class) pattern to all unit tests that were missing it. This ensures that the class system works correctly and prevents prototype pollution that was causing instability and cross-test contamination. Files updated:

  • test/playwright/unit/core/ClassConfigsAndFields.spec.mjs
  • test/playwright/unit/neo/MixinStaticConfig.spec.mjs
  • test/playwright/unit/state/Provider.spec.mjs
  • test/playwright/unit/vdom/AutoId.spec.mjs

This should resolve the TypeError: Neo.setupClass is not a function errors seen in CI.

tobiu closed this issue on Jan 19, 2026, 6:30 PM