object-path

object-path is a small, dependency-free JavaScript utility that solves a problem every codebase eventually runs into: safely reading or writing a value buried several levels deep inside an object, without a chain of manual ?. checks or risking a thrown error when an intermediate key is missing. It exposes a focused API — get, set, has, del, push, insert, empty, ensureExists, and coalesce — that all accept either a dot-notation string ("a.b.c") or an array of path segments, and it transparently supports numeric array indices within the same path.

Beyond convenience, the library has a track record of taking prototype-pollution security seriously: several point releases (0.11.0, 0.11.5, 0.11.6, 0.11.8) exist specifically to close pollution vectors in its optional “inherited properties” mode, and by default the library only ever touches an object’s own properties, refusing to walk the prototype chain unless explicitly configured to with includeInheritedProps. That makes it a common choice in codebases that need deep property access on user-supplied or otherwise untrusted objects.

What You Get

• A get(obj, path, defaultValue) function that safely reads a nested value and returns a fallback instead of throwing when any intermediate key is missing
• A set(obj, path, value, doNotReplace) function that creates any missing intermediate objects or arrays along the path automatically
• has, del, empty, push, insert, and ensureExists helpers covering the rest of common nested-mutation needs
• A coalesce(obj, paths, defaultValue) helper that returns the first defined value across a list of candidate paths
• Both a stateless module API (objectPath.get(obj, path)) and a bindable instance API (objectPath(obj).get(path)) for repeated access on the same object
• An opt-in includeInheritedProps mode (via objectPath.create() or the built-in objectPath.withInheritedProps instance) for the rarer case where prototype-chain properties should be visible too

Common Use Cases

• Reading optional, deeply nested configuration values from parsed JSON or YAML without a long chain of existence checks
• Safely mutating deeply nested state in a reducer or model layer, letting set create missing intermediate objects on the fly
• Building generic form or data-binding utilities that need to read/write arbitrary field paths supplied as strings at runtime
• Merging default values into a partially-specified options object via coalesce across several possible key locations
• Sanitizing or clearing sensitive nested fields with empty/del before logging or serializing an object

Under The Hood

Architecture The entire library lives in a single UMD-wrapped file (index.js) built around one factory(options) closure that produces an objectPath function/namespace; internal helpers (hasShallowProperty, getShallowPropertySafely, recursive set/get/del) are all closed over that per-instance options object, which is how the includeInheritedProps behavior branches without runtime type checks scattered through the public methods. The module exports one default instance plus objectPath.create(options) for building alternate instances and a pre-built objectPath.withInheritedProps instance — a small but deliberate configuration-via-closure pattern rather than a class hierarchy. Path resolution is uniformly recursive: string paths are split on . and numeric-looking segments are coerced via getKey, so get/set/del all reduce to the same array-walking recursion regardless of whether the caller passed a string or an array.

Tech Stack The runtime has zero production dependencies — pure ES5-style JavaScript wrapped in a UMD shim supporting CommonJS, AMD, and browser globals. Tooling is dated but functional: Mocha + Chai for tests, nyc for coverage, Coveralls for reporting, and a small custom @mariocasciaro/benchpress harness for benchmarking get/set/push throughput; CI runs through Travis. There is no build/bundle step and no TypeScript in the package itself (community .d.ts typings are referenced separately via DefinitelyTyped).

Code Quality The test suite (test.js) is extensive relative to the library’s size, covering unicode keys, dot-containing keys, array indices, missing-path defaults, and the inherited-properties security branches explicitly. Error handling is intentional rather than defensive noise: get/set return a caller-supplied default or undefined on a missing path instead of throwing, while the inherited-props mode deliberately throws on access to __proto__/constructor/prototype as a security guard. There is no TypeScript and no linter configuration in the repo, and the project has had long gaps between releases, but the core logic is small enough that the test coverage substitutes reasonably well for static typing.

What Makes It Unique The library’s differentiator isn’t the get/set/has surface itself — several utility libraries offer that — but its explicit, documented stance on prototype pollution: the default instance only ever touches an object’s own properties, and the opt-in inherited-properties instance actively throws when a path would touch a magic property like __proto__ or constructor. That security-first default, arrived at through several point-release CVE-style fixes, is unusual among small deep-access utilities that more commonly treat inherited-property access as an unexamined edge case.