Throw for invalid keys

Author: Mrtenz

packages/snaps-rpc-methods/src/permitted/getState.test.ts

@@ -29,11 +29,15 @@ describe('get', () => {
     expect(get(object, 'a.b.c.d')).toBeNull();
   });
 
-  it('returns `null` if the key is a prototype pollution attempt', () => {
-    expect(get(object, '__proto__.polluted')).toBeNull();
+  it('throws an error if the key is a prototype pollution attempt', () => {
+    expect(() => get(object, '__proto__.polluted')).toThrow(
+      'Invalid params: Key contains forbidden characters.',
+    );
   });
 
   it('returns `null` if the key is a constructor pollution attempt', () => {
-    expect(get(object, 'constructor.polluted')).toBeNull();
+    expect(() => get(object, 'constructor.polluted')).toThrow(
+      'Invalid params: Key contains forbidden characters.',
+    );
   });
 });

packages/snaps-rpc-methods/src/permitted/getState.ts

@@ -166,7 +166,9 @@ export function get(
 
   for (const currentKey of keys) {
     if (['__proto__', 'constructor'].includes(currentKey)) {
-      return null;
+      throw rpcErrors.invalidParams(
+        'Invalid params: Key contains forbidden characters.',
+      );
     }
 
     if (isPlainObject(result)) {

packages/snaps-rpc-methods/src/permitted/setState.test.ts

@@ -88,4 +88,16 @@ describe('set', () => {
       },
     });
   });
+
+  it('throws an error if the key is a prototype pollution attempt', () => {
+    expect(() => set({}, '__proto__.polluted', 'value')).toThrow(
+      'Invalid params: Key contains forbidden characters.',
+    );
+  });
+
+  it('throws an error if the key is a constructor pollution attempt', () => {
+    expect(() => set({}, 'constructor.polluted', 'value')).toThrow(
+      'Invalid params: Key contains forbidden characters.',
+    );
+  });
 });

packages/snaps-rpc-methods/src/permitted/setState.ts

@@ -202,7 +202,9 @@ export function set(
   for (let i = 0; i < keys.length; i++) {
     const currentKey = keys[i];
     if (['__proto__', 'constructor'].includes(currentKey)) {
-      return {};
+      throw rpcErrors.invalidParams(
+        'Invalid params: Key contains forbidden characters.',
+      );
     }
 
     if (i === keys.length - 1) {