Use Object.create() to create null prototype objects

The use of `__proto__` is deprecated.

Author: remcohaszing

src/nodes/Pair.ts

@@ -36,7 +36,7 @@ export class Pair<
     doc: Document<DocValue, boolean>,
     ctx: ToJSContext
   ): ReturnType<typeof addPairToJSMap> {
-    const pair = ctx.mapAsMap ? new Map() : { __proto__: null }
+    const pair = ctx.mapAsMap ? new Map() : Object.create(null)
     return addPairToJSMap(doc, ctx, pair, this)
   }
 

src/nodes/YAMLMap.ts

@@ -239,7 +239,7 @@ export class YAMLMap<
       ? new Type()
       : ctx?.mapAsMap
         ? new Map()
-        : { __proto__: null }
+        : Object.create(null)
     if (this.anchor) ctx.setAnchor(this, map)
     for (const pair of this.values.values()) addPairToJSMap(doc, ctx, map, pair)
     return map

tests/node-to-js.ts

@@ -17,12 +17,16 @@ describe('scalars', () => {
 describe('collections', () => {
   test('map', () => {
     const doc = parseDocument('key: 42')
-    expect(doc.value.toJS(doc)).toStrictEqual({ __proto__: null, key: 42 })
+    expect(doc.value.toJS(doc)).toStrictEqual(
+      Object.assign(Object.create(null), { key: 42 })
+    )
   })
 
   test('map in seq', () => {
     const doc = parseDocument<YAMLSeq, false>('- key: 42')
-    expect(doc.get(0).toJS(doc)).toStrictEqual({ __proto__: null, key: 42 })
+    expect(doc.get(0).toJS(doc)).toStrictEqual(
+      Object.assign(Object.create(null), { key: 42 })
+    )
   })
 })
 
@@ -51,10 +55,11 @@ describe('alias', () => {
       two: &b { key: *a }
       three: *b
     `)
-    expect(doc.get('three').toJS(doc)).toStrictEqual({
-      __proto__: null,
-      key: 42
-    })
+    expect(doc.get('three').toJS(doc)).toStrictEqual(
+      Object.assign(Object.create(null), {
+        key: 42
+      })
+    )
   })
 
   test('missing anchor', () => {

tests/properties.ts

@@ -9,7 +9,7 @@ function nullifyProto(value: unknown): unknown {
   if (Array.isArray(value)) {
     return value.map(nullifyProto)
   }
-  const result: Record<string, unknown> = { __proto__: null }
+  const result: Record<string, unknown> = Object.create(null)
   for (const key in value) {
     if (Object.hasOwn(value, key)) {
       result[key] = nullifyProto((value as Record<string, unknown>)[key])