fix: address cache cleanup code scanning warnings

Author: 2heal1

packages/webpack-bundler-runtime/src/clearCache.ts

@@ -66,9 +66,19 @@ type ClearCacheState = {
 
 const clearCacheStates = new WeakMap<WebpackRequire, ClearCacheState>();
 
-const hasOwn = (obj: Record<string | number, unknown>, key: string | number) =>
+const hasOwn = (obj: object, key: string | number) =>
   Object.prototype.hasOwnProperty.call(obj, key);
 
+const getOwn = <T>(
+  obj: Record<string | number, T> | undefined | null,
+  key: string | number,
+): T | undefined => {
+  if (!obj || !hasOwn(obj, key)) {
+    return undefined;
+  }
+  return obj[key];
+};
+
 const toList = <T>(value: T[] | undefined | null): T[] =>
   Array.isArray(value) ? value : [];
 
@@ -199,7 +209,7 @@ export const getRemoteKeysForChunk = (
     webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping ?? {};
 
   for (const remoteModuleId of toList(chunkMapping[chunkId])) {
-    const data = moduleIdToRemoteDataMapping[remoteModuleId];
+    const data = getOwn(moduleIdToRemoteDataMapping, remoteModuleId);
     if (data) {
       pushUnique(remoteKeys, [data.remoteName]);
     }
@@ -379,7 +389,7 @@ const getClearTarget = (
     toList(remotesLoadingData.remoteKeyToExternalModuleIds?.[remoteKey]),
   );
   for (const remoteModuleId of remoteModuleIds) {
-    const data = moduleIdToRemoteDataMapping[remoteModuleId];
+    const data = getOwn(moduleIdToRemoteDataMapping, remoteModuleId);
     if (data) {
       pushUnique(externalModuleIds, [data.externalModuleId]);
     }
@@ -421,19 +431,18 @@ const createClearSnapshot = (
   const idToExternalAndNameMapping =
     webpackRequire.federation.bundlerRuntimeOptions.remotes
       ?.idToExternalAndNameMapping ?? {};
+  const moduleIdToRemoteDataMapping =
+    webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping;
   const remoteLoadingPromises = remoteModuleIds.map((remoteModuleId) => {
-    const data =
-      webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping?.[
-        remoteModuleId
-      ];
+    const data = getOwn(moduleIdToRemoteDataMapping, remoteModuleId);
     return {
       data,
       had: data ? Object.prototype.hasOwnProperty.call(data, 'p') : false,
       value: data?.p,
     };
   });
   const runtimeLoadingPromises = remoteModuleIds.map((remoteModuleId) => {
-    const data = idToExternalAndNameMapping[remoteModuleId];
+    const data = getOwn(idToExternalAndNameMapping, remoteModuleId);
     return {
       data,
       had: data ? Object.prototype.hasOwnProperty.call(data, 'p') : false,
@@ -841,13 +850,19 @@ const cleanupStaleRemoteCache = (
   const idToExternalAndNameMapping =
     webpackRequire.federation.bundlerRuntimeOptions.remotes
       ?.idToExternalAndNameMapping ?? {};
+  const moduleIdToRemoteDataMapping =
+    webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping;
   cleanupNodeChunkCache(webpackRequire, target);
   for (const remoteModuleId of target.remoteModuleIds) {
-    const data =
-      webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping?.[
-        remoteModuleId
-      ];
-    const runtimeData = idToExternalAndNameMapping[remoteModuleId];
+    if (
+      remoteModuleId === '__proto__' ||
+      remoteModuleId === 'constructor' ||
+      remoteModuleId === 'prototype'
+    ) {
+      continue;
+    }
+    const data = getOwn(moduleIdToRemoteDataMapping, remoteModuleId);
+    const runtimeData = getOwn(idToExternalAndNameMapping, remoteModuleId);
     if (data) {
       delete data.p;
     }
@@ -940,13 +955,13 @@ const clearRemoteTarget = (
   const idToExternalAndNameMapping =
     webpackRequire.federation.bundlerRuntimeOptions.remotes
       ?.idToExternalAndNameMapping ?? {};
+  const moduleIdToRemoteDataMapping =
+    webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping;
   const pendingRemoteLoads: Promise<unknown>[] = [];
   for (const remoteModuleId of target.remoteModuleIds) {
     for (const data of [
-      webpackRequire.remotesLoadingData?.moduleIdToRemoteDataMapping?.[
-        remoteModuleId
-      ],
-      idToExternalAndNameMapping[remoteModuleId],
+      getOwn(moduleIdToRemoteDataMapping, remoteModuleId),
+      getOwn(idToExternalAndNameMapping, remoteModuleId),
     ]) {
       if (data?.p && typeof data.p === 'object' && 'then' in data.p) {
         pendingRemoteLoads.push(data.p.catch(() => {}));

tools/scripts/probe-modern-ssr-remove-remote-gc.mjs

@@ -223,11 +223,16 @@ async function requestProbe() {
 }
 
 function decodeHtml(value) {
-  return value
-    .replace(/"/g, '"')
-    .replace(/&/g, '&')
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>');
+  const entities = {
+    '&quot;': '"',
+    '&amp;': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+  };
+  return value.replace(
+    /&(quot|amp|lt|gt);/g,
+    (entity) => entities[entity] || entity,
+  );
 }
 
 function findSnapshot(result, label) {