noProto (JavaScript)

Language JavaScript (and super languages)

Summary

Rule available since: v2.3.8
Diagnostic Category: lint/suspicious/noProto
This rule is recommended, meaning it is enabled by default.
This rule doesn’t have a fix.
The default severity of this rule is warning.
Sources:
- Same as no-proto

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "suspicious": {
5
        "noProto": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the use of the deprecated __proto__ object property.

Object.prototype.__proto__ is a special accessor used to get or set the prototype of an object. \

However, it has been deprecated since ECMAScript 2009, being much slower and much less reliable than its modern counterparts Object.getPrototypeOf() and Object.setPrototypeOf().

Since it is a regular property on Object.prototype, __proto__ will not work on null-prototype objects that do not extend from Object.prototype nor ones having created their own __proto__ properties via Object.defineProperty.

As such, this rule encourages the use of Object.getPrototypeOf() and Object.setPrototypeOf() in lieu of directly accessing __proto__.

Note that this does not check for the use of __proto__ inside object literal definitions to set a newly created object’s prototype,
which is standard practice and well-optimized in modern browsers.

Examples

Invalid

1
obj.__proto__ = a;

code-block.js:1:1 lint/suspicious/noProto ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Avoid use of the deprecated __proto__ accessor.
  
  > 1 │ obj.__proto__ = a;
      │ ^^^^^^^^^^^^^
    2 │ 
  
  ℹ Object.prototype.__proto__ is an outdated way to get or set an object's prototype,
    having been deprecated in 2009 for being inefficient and unreliable.
  
  ℹ Object.getPrototypeOf() and Object.setPrototypeOf() are modern alternatives that work on all objects and are more performant.

1
const b = obj.__proto__;

code-block.js:1:11 lint/suspicious/noProto ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Avoid use of the deprecated __proto__ accessor.
  
  > 1 │ const b = obj.__proto__;
      │           ^^^^^^^^^^^^^
    2 │ 
  
  ℹ Object.prototype.__proto__ is an outdated way to get or set an object's prototype,
    having been deprecated in 2009 for being inefficient and unreliable.
  
  ℹ Object.getPrototypeOf() and Object.setPrototypeOf() are modern alternatives that work on all objects and are more performant.

Valid

1
const a = Object.getPrototypeOf(obj);

1
Object.setPrototypeOf(obj, b);

1
// This sets `foo`'s prototype to `null` (similar to `Object.create`), and is
2
// well-defined across browsers.
3
const foo = {
4
  __proto__: null,
5
  a: 1,
6
}