Scratch-www: Username "hasOwnProperty" crashes Join page

[apple502j]

If you put hasOwnProperty in the username slot of the Join page, and types other words, it will crash. This is probably caused at https://github.com/LLK/scratch-www/blob/develop/src/components/join-flow/username-step.jsx#L61

[BoomerScratch]

Log:
scratch.mit.edu-1588417381908.log
This only happens on the new registration page. It does not happen on the old registration page. (probably because the code is different on the old registration page)

[BryceLTaylor]

Prioritized lower than may be expected since I think it's really unlikely that a user will choose that username, and even less likely to be in a situation where that causes data loss.

[apple502j]

@BryceLTaylor Is this high impact or low impact?

[benjiwheeler]

@apple502j Low impact because only a tiny percentage of users will experience the problem.

[R4356th]

Using a numeral after it or using only lowercase letters should not cause this. I tried several times but the page crashed only twice.

[benjiwheeler]

A fix might be to replace the line @apple502j linked to:

        if (this.usernameRemoteCache.hasOwnProperty(username)) {

...with:

        if (typeof this.usernameRemoteCache[username] === 'Object') {

[GrahamSH-LLK]

Another note to this is that the username hasOwnProperty is taken, so most people will delete at least a character before it crashes.

[R4356th]

This bug does not crash the Join page for me any longer on Chrome Version 83.0.4103.61 (Official Build) (64-bit), Windows 10 Pro. However, it makes the Next button unresponsive while keeping other features of the page normal. This bug could be reproduced on Windows 10 Pro, Chrome 81.0.4044.138 (Official Build) (64-bit) as explained in the main comment before. However, I can still reproduce this bug on Microsoft Edge 44.18362.449.0 (Microsoft EdgeHTML 18.18363). The latest Chrome update could have caused this.

[AmazingMech2418]

I would like to mention that this might not have been completely fixed by LLK/scratch-www#4002 and a payload of __proto__ might cause the same issues, as well as potential prototype pollution.

[AmazingMech2418]

Actually, since __proto__ is a taken username, this isn't a problem. There are no other normal properties in the Object prototype either, luckily.