From 905e1ffdcefd8fbe626067427ea2b667b7c394e7 Mon Sep 17 00:00:00 2001
From: fan wu <336798967+FanWu-ai@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:28:58 -0700
Subject: [PATCH] fix(isIn): check object membership without calling shadowed
 methods

Use the intrinsic own-property check for null-prototype dictionaries and
objects containing a hasOwnProperty key. Add regression coverage.

AI assistance: OpenAI Codex.
---
 src/lib/isIn.js         |  2 +-
 test/validators.test.js | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/src/lib/isIn.js b/src/lib/isIn.js
index e7f15804f..0ffe09e26 100644
--- a/src/lib/isIn.js
+++ b/src/lib/isIn.js
@@ -15,7 +15,7 @@ export default function isIn(str, options) {
     }
     return array.indexOf(str) >= 0;
   } else if (typeof options === 'object') {
-    return options.hasOwnProperty(str);
+    return Object.prototype.hasOwnProperty.call(options, str);
   } else if (options && typeof options.indexOf === 'function') {
     return options.indexOf(str) >= 0;
   }
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..05f84eb42 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -6184,6 +6184,39 @@ describe('Validators', () => {
     });
   });
 
+  it('should validate membership in objects with no prototype', () => {
+    const values = Object.create(null);
+    values.foo = 1;
+    values.bar = 2;
+    test({
+      validator: 'isIn',
+      args: [values],
+      valid: ['foo', 'bar'],
+      invalid: ['missing', 'toString', 'constructor', ''],
+    });
+  });
+
+  it('should validate membership when hasOwnProperty is an object key', () => {
+    test({
+      validator: 'isIn',
+      args: [{ foo: 1, hasOwnProperty: 2 }],
+      valid: ['foo', 'hasOwnProperty'],
+      invalid: ['missing', 'toString', 'constructor', ''],
+    });
+  });
+
+  it('should not call an object membership value as hasOwnProperty', () => {
+    const values = Object.create({ inherited: 1 });
+    values.foo = 1;
+    values.hasOwnProperty = () => true;
+    test({
+      validator: 'isIn',
+      args: [values],
+      valid: ['foo', 'hasOwnProperty'],
+      invalid: ['missing', 'inherited', 'toString', ''],
+    });
+  });
+
   it('should validate ABA routing number', () => {
     test({
       validator: 'isAbaRouting',