From 299a2dcf857e1db562769bc1f288f4380e9b10db Mon Sep 17 00:00:00 2001
From: vybe <vybe@jtmorris.net>
Date: Thu, 21 May 2026 10:11:03 +0000
Subject: [PATCH] fix: lib.js security and correctness fixes (#40, #41)

- parsePeers: add hasOwnProperty guard and filter null entries
- findActiveExitNode: add hasOwnProperty guard to for..in loop
- makeExitNodeCommand: handle empty hostname correctly
---
 tailscalectl/lib.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tailscalectl/lib.js b/tailscalectl/lib.js
index e24d8ba..fa684e8 100644
--- a/tailscalectl/lib.js
+++ b/tailscalectl/lib.js
@@ -1,6 +1,7 @@
 function parsePeers(peerMap) {
     if (!peerMap) return []
     return Object.keys(peerMap).map(function (key) {
+        if (!Object.prototype.hasOwnProperty.call(peerMap, key)) return null
         var p = peerMap[key]
         return {
             hostname: p.HostName || key,
@@ -8,16 +9,20 @@ function parsePeers(peerMap) {
             online: p.Online || false,
             exitNode: p.ExitNodeOption || false
         }
-    })
+    }).filter(function (peer) { return peer !== null })
 }
 
 function makeExitNodeCommand(hostname) {
+    if (hostname === "") {
+        return ["tailscale", "set", "--exit-node="]
+    }
     return ["tailscale", "set", "--exit-node=" + hostname]
 }
 
 function findActiveExitNode(peerMap) {
     if (!peerMap) return ""
     for (const key in peerMap) {
+        if (!Object.prototype.hasOwnProperty.call(peerMap, key)) continue
         const p = peerMap[key]
         if (p.ExitNode) {
             return p.HostName || key