fix: validator.isValid is not a function for certain objects

[ej-shafran]

Description

Describe the purpose of this PR along with any background information and the impacts of the proposed change. For the benefit of the community, please do not assume prior context.

Objects with keys like valueOf, toString, and __proto__ cause a TypeError to be raised when calling jwt.sign. This is because the key technically does exist on the schema param of validate, when checked with if (schema[key]) {}. Using
Object.prototype.hasOwnProperty solves the issue.

Provide details that support your chosen implementation, including: breaking changes, alternatives considered, changes to the API, etc.

I used Object.prototype.hasOwnProperty.call(schema, key). This method has full browser support. Alternatively, lodash.has could be installed and used, but I think that would be overkill.

References

Include any links supporting this change such as a:

GitHub Issue/PR number addressed or fixed

Fixes #945

Testing

Describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

I have added test/issue_945.tests.js. It fails if the change made to sign.js is not present.

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[dubzzz]

As the issue has been detected via property based testing mechanisms, I wonder if at some point having such tests to cover this project could be a thing. It seems that it could be useful in addition to these tests to avoid regressions or even more nasty bugs such as things related to nested objects...