Which @angular/* package(s) are the source of the bug?

core

Is this a regression?

No

Description

TransferState uses a regular JavaScript object as its backing store.

Because get() reads with this.store[key], inherited properties can be returned even when hasKey() reports that the key does not exist.

For example:

const key = makeStateKey('constructor');

transferState.hasKey(key);     // false
transferState.get(key, null);  // inherited Object constructor

A more interesting case is __proto__. Writing an object under that key can change the prototype of the backing store instead of creating a normal entry.

In SSR applications that use dynamic resource() / rxResource() ids together with dictionary-shaped data, this can also affect HttpTransferCache, since it reads cached responses from the same TransferState.

Please provide a link to a minimal reproduction of the bug

See https://github.com/SkyZeroZx/angular-transferstate-routes-poc