Function followPath

src/core.ts:1487–1622

(value: unknown, parent: object | undefined,
                    path: PropertyPath, owner: RpcPayload | null)

};

function followPath(value: unknown, parent: object | undefined,
                    path: PropertyPath, owner: RpcPayload | null): FollowPathResult {
  for (let i = 0; i < path.length; i++) {
    parent = <object>value;

    let part = path[i];
    if (part in Object.prototype) {
      // Don't allow messing with Object.prototype properties over RPC. We block these even if
      // the specific object has overridden them for consistency with the deserialization code,
      // which will refuse to deserialize an object containing such properties. Anyway, it's
      // impossible for a normal client to even request these because accessing Object prototype
      // properties on a stub will resolve to the local prototype property, not making an RPC at
      // all.
      value = undefined;
      continue;
    }

    let kind = typeForRpc(value);
    switch (kind) {
      case "object":
      case "function":
        // Must be own property, NOT inherited from a prototype.
        if (Object.hasOwn(<object>value, part)) {
          value = (<any>value)[part];
        } else {
          value = undefined;
        }
        break;

      case "array":
        // For arrays, restrict specifically to numeric indexes, to be consistent with
        // serialization, which only sends a flat list.
        if (Number.isInteger(part) && <number>part >= 0) {
          value = (<any>value)[part];
        } else {
          value = undefined;
        }
        break;

      case "rpc-target":
      case "rpc-thenable": {
        // Must be prototype property, and must NOT be inherited from `Object`.
        if (Object.hasOwn(<object>value, part)) {
          // We throw an error in this case, rather than return undefined, because otherwise
          // people tend to get confused about this. If you don't want it to be possible to
          // probe the existence of your instance properties, make them properly private (prefix
          // with #).
          throw new TypeError(
              `Attempted to access property '${part}', which is an instance property of the ` +
              `RpcTarget. To avoid leaking private internals, instance properties cannot be ` +
              `accessed over RPC. If you want to make this property available over RPC, define ` +
              `it as a method or getter on the class, instead of an instance property.`);
        } else {
          value = (<any>value)[part];
        }

        // Since we're descending into the RpcTarget, the rest of the path is not "owned" by any
        // RpcPayload.