[keichi]

Problem

An array with the key option builds its result as lhs = {} and assigns entries with lhs[item.key] = item. When the key value comes from parsed input and equals "__proto__", the assignment triggers the __proto__ setter and replaces the hash's prototype with the parsed item instead of adding an entry. The entry vanishes from Object.keys(), and missing properties on the hash resolve to attacker-controlled data.

Repro

const parser = new Parser().array("a", {
  type: new Parser().uint8("l").string("k", { length: "l" }).uint8("evil"),
  lengthInBytes: 11,
  key: "k",
});
const r = parser.parse(Buffer.from([9, ...Buffer.from("__proto__"), 1]));
Object.keys(r.a); // []
r.a.evil;         // 1

Fix

Use Object.defineProperty (enumerable, writable, configurable) for the assignment, so every key, "__proto__" included, becomes an own data property.

I picked this over Object.create(null) because the result stays a plain object with Object.prototype. Existing users can still call hasOwnProperty/toString on it, and strict deep equality (e.g. toStrictEqual, which compares prototypes) keeps working, so existing tests and user code see no change.

A regression test is added in test/composite_parser.ts.