Added checks for __proto__.

Author: uhop

AGENTS.md

@@ -109,6 +109,7 @@ stream-json/
 - **Keep `.js` and `.d.ts` files in sync** for all modules under `src/`.
 - **Token-based architecture.** The parser produces a stream of `{name, value}` tokens. All filters, streamers, and utilities operate on this token protocol.
 - **Backpressure must be handled correctly.** All stream components rely on Node.js stream infrastructure via `stream-chain`.
+- **Intended input is data the user owns or trusts** (dumps, exports, logs). The library is not designed for hostile input; docs say so, and code changes are not hardened against adversarial JSON beyond `JSON.parse` parity (`__proto__` becomes an own property) and the filters' `maxDepth` guard.
 
 ## Architecture
 
@@ -118,6 +119,7 @@ stream-json/
 - **Assembler** (`src/assembler.js`, implementation in `src/core/assembler.js`) interprets the token stream and reconstructs JavaScript objects. Plain class — no `EventEmitter` inheritance in 3.x.
   - Used internally by all streamers via `streamBase`.
   - Reads only packed tokens (`keyValue`, `stringValue`, `numberValue`); streamed chunks are ignored.
+  - Materializes like `JSON.parse`: a `__proto__` key becomes an own property via `Object.defineProperty`, never the prototype (plain assignment would hit the inherited setter). Same in `FlexAssembler`.
   - `Assembler.connectTo(stream, {onDone: asm => …})` is substrate-aware: accepts either a Node `Readable` (attaches `'data'` listener) or a Web `ReadableStream` (pumps via `getReader()`). Detection via `typeof stream.getReader === 'function'`. `asm.onDone(fn)` can set/clear the callback after construction.
   - For hot paths, prefer a manual `for await (const tok of readable) asm.consume(tok)` loop over `connectTo` — no async-closure overhead, errors propagate directly. `FlexAssembler` has the same shape.
   - `asm.tapChain` is a function for use in `chain()`.

ARCHITECTURE.md

@@ -128,6 +128,7 @@ The typings name the stage shapes as exported aliases on the parser entries (`co
 - `Assembler.connectTo(stream, {onDone})` — accepts either a Node `Readable` or a Web `ReadableStream`; detects the substrate via `typeof stream.getReader === 'function'` and either pumps via `getReader()` (Web) or listens on `'data'` (Node). The `onDone(asm)` callback fires when a top-level value is assembled. The 2.x `EventEmitter` shape (`asm.on('done', …)`) is removed in 3.0 — use the `onDone` option or `asm.onDone(fn)`.
 - `asm.tapChain` — a function for use in `chain()` that returns assembled values or `none`.
 - Tracks `depth`, `path`, `current`, `key`, `stack`.
+- Writes keys like `JSON.parse`: a `__proto__` key becomes an own data property (`Object.defineProperty`); plain assignment would invoke the inherited setter and replace the object's prototype. `FlexAssembler` does the same for plain objects.
 - Supports `reviver` option (like `JSON.parse` reviver) and `numberAsString`.
 
 ### Disassembler

README.md

@@ -14,6 +14,10 @@ Why it might be for you:
 - **Performance-minded.** The parser and assemblers are measured and tuned along the hot paths. Real numbers depend on your data and hardware, so [benchmark](https://github.com/uhop/stream-json/wiki/Benchmarks) on your own.
 - **Solid.** ESM, bundled TypeScript typings, and a broad test suite exercised across Node, Bun, Deno, and the browser.
 
+## Intended input
+
+`stream-json` is built for data you own or trust — database dumps, exports, logs, and files produced by your own systems. It is not designed for hostile input: do not feed it JSON from the open internet or from untrusted users. Untrusted JSON needs validation of its own before it reaches a pipeline.
+
 ## Example
 
 Pull one array out of a JSON document larger than memory and tally it — one record at a time, in constant memory:

llms-full.txt

@@ -14,6 +14,8 @@
 - Proper backpressure handling via Node.js stream infrastructure
 - Works with `stream-chain` for pipeline composition
 
+**Intended input:** data you own or trust — database dumps, exports, logs, files produced by your own systems. `stream-json` is not designed for hostile input: do not feed it JSON from the open internet or from untrusted users; untrusted JSON needs validation of its own before it reaches a pipeline.
+
 ## Quick start
 
 Install:
@@ -196,7 +198,7 @@ parserStream.on('data', token => console.log(token.name));
 
 ## Assembler
 
-`Assembler` — a plain class (no `EventEmitter` inheritance) that interprets the token stream and reconstructs JavaScript objects. It reads only packed tokens (`keyValue`, `stringValue`, `numberValue`); streamed chunks are ignored, so the parser must pack keys, strings, and numbers (its default). 3.0 dropped the `'done'` event in favor of an `onDone` callback option.
+`Assembler` — a plain class (no `EventEmitter` inheritance) that interprets the token stream and reconstructs JavaScript objects. It reads only packed tokens (`keyValue`, `stringValue`, `numberValue`); streamed chunks are ignored, so the parser must pack keys, strings, and numbers (its default). It materializes like `JSON.parse`: a `__proto__` key becomes an own property; the object's prototype is never touched. 3.0 dropped the `'done'` event in favor of an `onDone` callback option.
 
 Constructor options:
 - `reviver` (function) — like `JSON.parse` reviver. Called as `reviver(key, value)`.

llms.txt

@@ -2,6 +2,8 @@
 
 > Micro-library of Node.js stream components for creating custom JSON processing pipelines with a minimal memory footprint. Parse JSON files far exceeding available memory using a SAX-inspired streaming token API. One dependency: `stream-chain`.
 
+**Intended input:** data you own or trust (database dumps, exports, logs, your own systems' files). Not designed for hostile input — do not feed it JSON from the open internet or from untrusted users; validate untrusted JSON before it reaches a pipeline.
+
 ## Install
 
 npm i stream-json
@@ -67,7 +69,7 @@ For the SAX-style event API on Web, use the `EventTarget`-based variants from `s
 
 ### Assembler
 
-`Assembler` — class that reconstructs JS objects from tokens. Reads only packed tokens (`keyValue`, `stringValue`, `numberValue`); streamed chunks are ignored. Receives a per-value callback via the `onDone` option.
+`Assembler` — class that reconstructs JS objects from tokens. Reads only packed tokens (`keyValue`, `stringValue`, `numberValue`); streamed chunks are ignored. Materializes like `JSON.parse`: a `__proto__` key becomes an own property, never the prototype. Receives a per-value callback via the `onDone` option.
 
 ```js
 import Assembler from 'stream-json/assembler.js';

src/core/assembler.d.ts

@@ -37,6 +37,9 @@ export interface AssemblerOptions<T = unknown> {
  * chunks are ignored, so the upstream parser must pack keys, strings, and numbers
  * (its default).
  *
+ * Materializes like `JSON.parse`: a `__proto__` key becomes an own property; the
+ * object's prototype is never touched.
+ *
  * Generic in `T` (default `unknown`) — the type of the fully assembled value.
  * Declare `new Assembler<MyShape>()` to type `current` and `tapChain()`. Read
  * `current` in the `onDone` callback (when it actually holds the completed `T`);

src/core/assembler.js

@@ -157,7 +157,12 @@ class Assembler {
     if (this.current instanceof Array) {
       this.current.push(value);
     } else {
-      this.current[this.key] = value;
+      // like JSON.parse: an own property, never the inherited __proto__ setter
+      if (this.key === '__proto__') {
+        Object.defineProperty(this.current, this.key, {value, writable: true, enumerable: true, configurable: true});
+      } else {
+        this.current[this.key] = value;
+      }
       this.key = null;
     }
   }
@@ -177,7 +182,11 @@ class Assembler {
     } else {
       value = this.reviver.call(this.current, this.key, value);
       if (value !== undefined) {
-        this.current[this.key] = value;
+        if (this.key === '__proto__') {
+          Object.defineProperty(this.current, this.key, {value, writable: true, enumerable: true, configurable: true});
+        } else {
+          this.current[this.key] = value;
+        }
       }
       this.key = null;
     }

src/core/utils/flex-assembler.d.ts

@@ -22,6 +22,9 @@ type TokenSource = ReadableStream<Token> | ReadableLike;
  * chunks are ignored, so the upstream parser must pack keys, strings, and numbers
  * (its default).
  *
+ * Materializes like `JSON.parse`: a `__proto__` key becomes an own property; the
+ * object's prototype is never touched.
+ *
  * Generic in `T` (default `unknown`) — the type of the fully assembled value
  * (`current` / `tapChain()`). Orthogonal to the per-rule container type `C` on
  * `ObjectRule<C>` / `ArrayRule<C>`: `T` is the whole result, `C` is one custom

src/core/utils/flex-assembler.js

@@ -253,6 +253,9 @@ class FlexAssembler {
       }
       if (this.rule) {
         this.rule.add(this.current, this.key, value);
+      } else if (this.key === '__proto__') {
+        // like JSON.parse: an own property, never the inherited __proto__ setter
+        Object.defineProperty(this.current, this.key, {value, writable: true, enumerable: true, configurable: true});
       } else {
         this.current[this.key] = value;
       }

tests/node/test-assembler.js

@@ -278,3 +278,42 @@ test.asPromise('assembler: chain', (t, resolve, reject) => {
     });
   });
 });
+
+const PROTO_VECTORS = [
+  '{"__proto__":{"isAdmin":true},"name":"bob"}',
+  '{"__proto__":null,"name":"bob"}',
+  '{"__proto__":{"hasOwnProperty":1},"name":"bob"}',
+  '{"user":{"__proto__":{"isAdmin":true},"name":"alice"}}'
+];
+
+const checkProtoParity = (t, actual, expected) => {
+  const inner = actual.user || actual,
+    innerExpected = expected.user || expected;
+  t.deepEqual(actual, expected);
+  t.deepEqual(Object.keys(inner), Object.keys(innerExpected), 'same own keys as JSON.parse');
+  t.ok(Object.hasOwn(inner, '__proto__'), '__proto__ is an own property');
+  t.equal(Object.getPrototypeOf(inner), Object.prototype, 'prototype untouched');
+  t.equal(inner.isAdmin, undefined, 'nothing inherited');
+  t.equal(typeof inner.hasOwnProperty, 'function', 'Object.prototype methods intact');
+};
+
+const assembleProto = (text, options) =>
+  new Promise((resolve, reject) => {
+    const asm = assembler(options),
+      pipeline = chain([readString(text), parser(), asm.tapChain]);
+    pipeline.on('error', reject);
+    pipeline.on('end', () => resolve(asm.current));
+    pipeline.resume();
+  });
+
+test.asPromise('assembler: __proto__ key becomes an own property, like JSON.parse', async (t, resolve, reject) => {
+  try {
+    for (const text of PROTO_VECTORS) {
+      checkProtoParity(t, await assembleProto(text), JSON.parse(text));
+      checkProtoParity(t, await assembleProto(text, {reviver: (_key, value) => value}), JSON.parse(text));
+    }
+    resolve();
+  } catch (e) {
+    reject(e);
+  }
+});