[Bug]: A member named __proto__ is silently dropped from a decorator's object value

[marvin-hsu]

The compiler marshals an object value before it passes that value to a
decorator, and it adds each member by assignment. An assignment to __proto__
sets the prototype instead of adding a member, so that member never reaches the
decorator and no diagnostic reports it.

The reproduction emits this, with no warning and no error:

x-c-control: # the control, an ordinary member name
  normal:
    polluted: true
  ok: 1
x-b-string: # `__proto__` holding a string
  ok: 1
x-a-object: # `__proto__` holding an object
  ok: 1

The control keeps both members. Only the two cases that name a member
__proto__ lose one, so the name decides it — not the nesting, and not the
emitter.

The document cannot show the second effect. When the lost member holds an
object or an array, that value becomes the prototype of the marshalled object.
Measured in a decorator of my own, and still present in 1.15.0:

own=["ok"]  prototypeOwnNames=["polluted"]  value.polluted === true

polluted is never a member of that object. It is a name the .tsp author
chose, so a decorator that reads any name it did not declare can read the
author's data.

Every decorator taking an object value is affected.

The assignment is objectValueToJs, still the same on main
today:

function objectValueToJs(type: ObjectValue): Record<string, unknown> {
  const result: Record<string, unknown> = {};
  for (const [key, value] of type.properties) {
    result[key] = marshalTypeForJs(value.value, undefined);
  }
  return result;
}

The other direction in the same file already handles the name.
unmarshalJsToValue collects members into a Map, which
takes __proto__ as an ordinary key. So the two directions disagree about it.

Suggested fix: build the object with Object.create(null), or add each
member with Object.defineProperty.

I keep the case as a failing test
here,
so it turns green if this changes.

Playground Link

[github-actions]

🎯 Issue Triage

The objectValueToJs function in js-marshaller.ts silently drops object members named __proto__ because plain property assignment triggers JavaScript's prototype setter. When the value is an object, it also causes prototype pollution — the value becomes the prototype of the marshalled result, leaking the author's property names to any decorator.

Category: Bug

Area: compiler:core

🔗 [Playground Reproduction]((typespec.io/redacted)

📋 Reproduction code

import "`@typespec/http`";
import "`@typespec/openapi`";
using TypeSpec.Http;
using TypeSpec.OpenAPI;

`@service`(#{ title: "Marshall demo" })
namespace Demo;

`@extension`("x-a-object", #{ __proto__: #{ polluted: true }, ok: 1 })
`@extension`("x-b-string", #{ __proto__: "written" })
`@extension`("x-c-control", #{ normal: #{ polluted: true }, ok: 1 })
model Widget {
  id: string;
}

🔍 Analysis

Root cause: objectValueToJs builds its result with result[key] = value. When key === "__proto__", JavaScript invokes the Object.prototype.__proto__ setter instead of creating a data property, causing:

1. The member is silently dropped.
2. If the value is an object, it becomes the prototype of result (prototype pollution).

Asymmetry: The reverse direction unmarshalJsToValue already handles __proto__ safely by collecting into a Map.

Suggested fix: Initialize with Object.create(null) or use Object.defineProperty for each assignment.

Affected versions: Confirmed in 1.15.0 and current main.

📝 Suggested next steps

• Fix objectValueToJs in packages/compiler/src/core/js-marshaller.ts — use Object.create(null) or Object.defineProperty instead of direct key assignment.
• Add regression tests for __proto__ as a member name (string value and object value).
• Audit other places in the compiler that build plain objects from user-supplied keys.

Generated by Agentic Triage