no-prototype-builtins

data.hasOwnProperty("id") only works if data inherits the method and doesn't define a property with that name itself. An object made with Object.create(null) doesn't inherit it, so the call throws. An object parsed from JSON can have its own hasOwnProperty key, so anyone who sends the input can make the call throw too.

The rule reports calls to hasOwnProperty, isPrototypeOf and propertyIsEnumerable. Use Object.hasOwn(), or call the method from Object.prototype.

This rule is on by default.

Configure

On by default as a warning. To turn it off:

[lint.rules]
"no-prototype-builtins" = "off" # or "error"

Examples

Reported:

const data = JSON.parse(body);

if (data.hasOwnProperty("id")) {
  update(data.id);
}

const isChild = base.isPrototypeOf(data);

Not reported:

const data = JSON.parse(body);

if (Object.hasOwn(data, "id")) {
  update(data.id);
}

const isChild = Object.prototype.isPrototypeOf.call(base, data);