Map data rows to objects keyed by the header column names.
The keys are attacker-controllable (they come from the CSV header row of a
possibly-hostile or MITM'd response). Building on a null prototype
(Object.create(null)) so a __proto__/constructor/prototype header
cannot reach an inherited accessor or shadow an inherited method: it becomes
an ordinary own data property. This closes the prototype-pollution class as
defence-in-depth. Consumers only read fixed string keys and JSON.stringify
the result, both of which work identically on a null-prototype object.
Map data rows to objects keyed by the header column names.
The keys are attacker-controllable (they come from the CSV header row of a possibly-hostile or MITM'd response). Building on a
nullprototype (Object.create(null)) so a__proto__/constructor/prototypeheader cannot reach an inherited accessor or shadow an inherited method: it becomes an ordinary own data property. This closes the prototype-pollution class as defence-in-depth. Consumers only read fixed string keys andJSON.stringifythe result, both of which work identically on a null-prototype object.