fix: harden language normalization and add tests

Use Object.hasOwn instead of `in` operator in code block language
matching to avoid prototype property collisions. Extract the
EMPTY_VALUE sentinel into a shared constant to eliminate duplication
across CodeMirrorEditor, ChangeCodeMirrorLanguage, and the
normalization function. Add unit tests for normalizeCodeBlockLanguages
covering both record and array formats.

Author: petyosi

src/plugins/codemirror/CodeMirrorEditor.tsx

@@ -12,12 +12,11 @@ import { indentWithTab } from '@codemirror/commands'
 import { basicLight } from 'cm6-theme-basic-light'
 import { basicSetup } from 'codemirror'
 import { $setSelection } from 'lexical'
-import { codeBlockLanguages$, codeMirrorAutoLoadLanguageSupport$, codeMirrorExtensions$ } from '.'
+import { EMPTY_VALUE, codeBlockLanguages$, codeMirrorAutoLoadLanguageSupport$, codeMirrorExtensions$ } from '.'
 import { useCodeMirrorRef } from '../sandpack/useCodeMirrorRef'
 import { Select } from '../toolbar/primitives/select'
 
 export const COMMON_STATE_CONFIG_EXTENSIONS: Extension[] = []
-const EMPTY_VALUE = '__EMPTY_VALUE__'
 
 export const CodeMirrorEditor = ({ language, nodeKey, code, focusEmitter }: CodeBlockEditorProps) => {
   const t = useTranslation()

src/plugins/codemirror/index.tsx

@@ -4,6 +4,11 @@ import { CodeBlockEditorDescriptor, appendCodeBlockEditorDescriptor$, insertCode
 import { CodeMirrorEditor } from './CodeMirrorEditor'
 import { Extension } from '@codemirror/state'
 
+/**
+ * @internal
+ */
+export const EMPTY_VALUE = '__EMPTY_VALUE__'
+
 /**
  * A code block language entry with a name and optional aliases/extensions.
  * Compatible with CodeMirror's `LanguageDescription` from `@codemirror/language-data`.
@@ -61,9 +66,9 @@ export function normalizeCodeBlockLanguages(input: Record<string, string> | Code
     for (const [key, label] of Object.entries(input)) {
       if (!(label in firstKeyByLabel)) {
         firstKeyByLabel[label] = key
-        items.push({ value: key || '__EMPTY_VALUE__', label })
+        items.push({ value: key || EMPTY_VALUE, label })
       }
-      keyMap[key] = firstKeyByLabel[label] || '__EMPTY_VALUE__'
+      keyMap[key] = firstKeyByLabel[label] || EMPTY_VALUE
     }
   }
 
@@ -162,7 +167,7 @@ export const codeMirrorPlugin = realmPlugin<{
 function buildCodeBlockDescriptor(normalized: NormalizedCodeBlockLanguages): CodeBlockEditorDescriptor {
   return {
     match(language, meta) {
-      return (language ?? '') in normalized.keyMap && !meta
+      return Object.hasOwn(normalized.keyMap, language ?? '') && !meta
     },
     priority: 1,
     Editor: CodeMirrorEditor

src/plugins/toolbar/components/ChangeCodeMirrorLanguage.tsx

@@ -2,11 +2,10 @@ import { useCellValues } from '@mdxeditor/gurx'
 import React from 'react'
 import styles from '../../../styles/ui.module.css'
 import { $isCodeBlockNode } from '../../codeblock/CodeBlockNode'
-import { codeBlockLanguages$ } from '../../codemirror'
+import { EMPTY_VALUE, codeBlockLanguages$ } from '../../codemirror'
 import { activeEditor$, editorInFocus$, useTranslation } from '../../core'
 import { Select } from '.././primitives/select'
 
-const EMPTY_VALUE = '__EMPTY_VALUE__'
 /**
  * A component that allows the user to change the code block language of the current selection.
  * For this component to work, you must enable the `codeMirrorPlugin` for the editor.

src/test/codemirror.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeCodeBlockLanguages, EMPTY_VALUE } from '../plugins/codemirror'
+
+describe('normalizeCodeBlockLanguages', () => {
+  describe('record format', () => {
+    it('produces items and identity keyMap for simple input', () => {
+      const result = normalizeCodeBlockLanguages({ js: 'JavaScript', css: 'CSS' })
+      expect(result.items).toEqual([
+        { value: 'js', label: 'JavaScript' },
+        { value: 'css', label: 'CSS' }
+      ])
+      expect(result.keyMap).toEqual({ js: 'js', css: 'css' })
+    })
+
+    it('deduplicates entries with the same label', () => {
+      const result = normalizeCodeBlockLanguages({
+        js: 'JavaScript',
+        javascript: 'JavaScript',
+        css: 'CSS'
+      })
+      expect(result.items).toEqual([
+        { value: 'js', label: 'JavaScript' },
+        { value: 'css', label: 'CSS' }
+      ])
+      expect(result.keyMap['js']).toBe('js')
+      expect(result.keyMap['javascript']).toBe('js')
+    })
+
+    it('handles empty string key using EMPTY_VALUE sentinel', () => {
+      const result = normalizeCodeBlockLanguages({ '': 'Unspecified', js: 'JavaScript' })
+      expect(result.items).toEqual([
+        { value: EMPTY_VALUE, label: 'Unspecified' },
+        { value: 'js', label: 'JavaScript' }
+      ])
+      expect(result.keyMap['']).toBe(EMPTY_VALUE)
+    })
+  })
+
+  describe('array format', () => {
+    it('uses first alias as canonical key', () => {
+      const result = normalizeCodeBlockLanguages([
+        { name: 'JavaScript', alias: ['js', 'javascript'] },
+        { name: 'CSS', alias: ['css'] }
+      ])
+      expect(result.items).toEqual([
+        { value: 'js', label: 'JavaScript' },
+        { value: 'css', label: 'CSS' }
+      ])
+      expect(result.keyMap['js']).toBe('js')
+      expect(result.keyMap['javascript']).toBe('js')
+      expect(result.keyMap['css']).toBe('css')
+    })
+
+    it('falls back to lowercased name when no aliases', () => {
+      const result = normalizeCodeBlockLanguages([{ name: 'Python' }])
+      expect(result.items).toEqual([{ value: 'python', label: 'Python' }])
+      expect(result.keyMap['python']).toBe('python')
+    })
+
+    it('maps extensions into keyMap', () => {
+      const result = normalizeCodeBlockLanguages([
+        { name: 'TypeScript', alias: ['ts', 'typescript'], extensions: ['ts', 'mts'] }
+      ])
+      expect(result.keyMap['ts']).toBe('ts')
+      expect(result.keyMap['typescript']).toBe('ts')
+      expect(result.keyMap['mts']).toBe('ts')
+    })
+
+    it('maps lowercased name into keyMap', () => {
+      const result = normalizeCodeBlockLanguages([
+        { name: 'JavaScript', alias: ['js'] }
+      ])
+      expect(result.keyMap['javascript']).toBe('js')
+    })
+  })
+
+  describe('empty input', () => {
+    it('handles empty record', () => {
+      const result = normalizeCodeBlockLanguages({})
+      expect(result.items).toEqual([])
+      expect(result.keyMap).toEqual({})
+    })
+
+    it('handles empty array', () => {
+      const result = normalizeCodeBlockLanguages([])
+      expect(result.items).toEqual([])
+      expect(result.keyMap).toEqual({})
+    })
+  })
+})