# Need advice on prototype pollution breaking (for example) Array.find(), causing issues with other nodes

**URL:** <https://discourse.nodered.org/t/need-advice-on-prototype-pollution-breaking-for-example-array-find-causing-issues-with-other-nodes/13543>\
**Category:** Core Development\
**Created:** [22 July 2019 10:34 UTC](https://discourse.nodered.org/t/need-advice-on-prototype-pollution-breaking-for-example-array-find-causing-issues-with-other-nodes/13543 "2019-07-22T10:34:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [22 July 2019 10:34 UTC](https://discourse.nodered.org/t/need-advice-on-prototype-pollution-breaking-for-example-array-find-causing-issues-with-other-nodes/13543/1 "2019-07-22T10:34:26Z")

</div>

Hi, I am updating a cron type node and using a new library that works perfectly outside of node-red but has (had) a serious bug when ran inside a custom node.

_ **fore warning...** _  
_I had an old version of `node-red-contrib-opcua` installed globally that used an old shim lib called `collections` that changed the implementation of `Array.find()`_

**The issue...**

- An older install of `node-red-contrib-opcua` has a dependency on collections V^3.0.0
- This library [unconditionally defines `Array.find()`](https://github.com/montagejs/collections/blob/v3.0.0/shim-array.js#L135) function that returns an **index or -1**
- Normally `Array.find()` returns the **'found item' or `undefined`** ([see here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/find))

Essentially, if I (or anyone) has an older version of `node-red-contrib-opcua` (or any other node that has bad shims) things like this bad implementation of `Array.find()` will cause bugs and other side-effects.

**Questions**

- Is there some way of identifying a node.js prototype is overwritten (especially on things like the now standard `Array`)?
  - is this perhaps something node-red could/should do?

- Is there a way to undo the overwritten `find` function? Revert it to original node.js implementation?
- Is there another way to handle it - perhaps my own shim to ensure functionality?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [22 July 2019 16:31 UTC](https://discourse.nodered.org/t/need-advice-on-prototype-pollution-breaking-for-example-array-find-causing-issues-with-other-nodes/13543/2 "2019-07-22T16:31:55Z")

</div>

I reported the bug on that nasty piece of code. I believe that it uses `Array.prototype.find` which globally redefines the Array object for all code. It is utterly unnecessary of course & very dangerous. I reported it because someone reported a bug in uibuilder - of course, it wasn't in uibuilder (how could it be!!) but it did cause it to crash.

> [@Steve-Mcl](#):
>
> Is there some way of identifying a node.js prototype is overwritten (especially on things like the now standard `Array` )?

While I'm not a great JavaScript expert, I don't believe that JS has sufficient introspection capabilities to do this even with the latest versions of JS which, at least, are getting better at being able to introspect code.

I think that you would have to understand a reference model of JS in order to be able to pick up the differences and that, of course, is infeasible.

> [@Steve-Mcl](#):
>
> Is there a way to undo the overwritten `find` function? Revert it to original node.js implementation?

Well, if you know that it has happened then you can use the same trick to rewrite the prototype for `Array.prototype.find()` but you will have to implement the function yourself, the original definition (likely in C++ code) is not available.

I note one, extremely hacky, workaround that you might be able to adapt for Node.js insead of the browser:

> <https://stackoverflow.com/questions/8580431/recovering-built-in-methods-that-have-been-overwritten>

> [@Steve-Mcl](#):
>
> Is there another way to handle it - perhaps my own shim to ensure functionality?

Yes, fork the _`node-red-contrib-opcua`_ node and fix it 😉 It has, after all, caused a lot of confusion and wasted time.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [22 July 2019 17:16 UTC](https://discourse.nodered.org/t/need-advice-on-prototype-pollution-breaking-for-example-array-find-causing-issues-with-other-nodes/13543/3 "2019-07-22T17:16:33Z")

</div>

> [@TotallyInformation](#):
>
> Yes, fork the _`node-red-contrib-opcua`_ node and fix it 😉 It has, after all, caused a lot of confusion and wasted time

Certainly cost me a few hours.

Fortunately, they seem to have removed this in the latest version.

It was mostly academic at this point.

Cheers.