chore: guard against inherited properties

index.js

@@ -40,12 +40,14 @@ function RedisClient (options, stream) {
   const cnxOptions = {}
   /* istanbul ignore next: travis does not work with stunnel atm. Therefore the tls tests are skipped on travis */
   for (const tlsOption in options.tls) {
+    if (options.tls.hasOwnProperty(tlsOption)) {
       cnxOptions[tlsOption] = options.tls[tlsOption]
       // Copy the tls options into the general options to make sure the address is set right
       if (tlsOption === 'port' || tlsOption === 'host' || tlsOption === 'path' || tlsOption === 'family') {
         options[tlsOption] = options.tls[tlsOption]
       }
     }
+  }
   if (stream) {
     // The stream from the outside is used so no connection from this side is triggered but from the server this client should talk to
     // Reconnect etc won't work with this. This requires monkey patching to work, so it is not officially supported
@@ -69,8 +71,10 @@ function RedisClient (options, stream) {
     options.socketKeepalive = true
   }
   for (const command in options.renameCommands) {
+    if (options.renameCommands.hasOwnProperty(command)) {
       options.renameCommands[command.toLowerCase()] = options.renameCommands[command]
     }
+  }
   options.returnBuffers = !!options.returnBuffers
   options.detectBuffers = !!options.detectBuffers
   // Override the detectBuffers setting if returnBuffers is active and print a warning

lib/createClient.js

@@ -42,6 +42,9 @@ module.exports = function createClient (portArg, hostArg, options) {
       if (parsed.search !== '') {
         var elem
         for (elem in parsed.query) {
+          if (!parsed.query.hasOwnProperty(elem)) {
+            continue
+          }
           // If options are passed twice, only the parsed options will be used
           if (elem in options) {
             if (options[elem] === parsed.query[elem]) {

lib/extendedApi.js

@@ -85,8 +85,10 @@ RedisClient.prototype.duplicate = function (options, callback) {
   const existingOptions = utils.clone(this.options)
   options = utils.clone(options)
   for (const elem in options) {
+    if (options.hasOwnProperty(elem)) {
       existingOptions[elem] = options[elem]
     }
+  }
   const client = new RedisClient(existingOptions)
   client.selectedDb = this.selectedDb
   if (typeof callback === 'function') {

lib/readyHandler.js

@@ -72,6 +72,7 @@ function onReady (client) {
   if (!client.options.disableResubscribing && callbackCount) {
     debug('Sending pub/sub onReady commands')
     for (const key in client.subscriptionSet) {
+      if (client.subscriptionSet.hasOwnProperty(key)) {
         const command = key.slice(0, key.indexOf('_'))
         const args = client.subscriptionSet[key]
         client[command]([args]).catch((err) => {
@@ -81,6 +82,7 @@ function onReady (client) {
         })
       }
     }
+  }
   client.sendOfflineQueue()
   client.emit('ready')
 }