From cbba33bc1526a3fb0901a8704fda85c1e7471712 Mon Sep 17 00:00:00 2001
From: jmoenig <jens@moenig.org>
Date: Tue, 9 Mar 2021 12:15:43 +0100
Subject: [PATCH] prevent inserting items at non-integer / out-of-bounds
 indices

---
 HISTORY.md   |  4 +++-
 snap.html    |  2 +-
 src/lists.js | 18 ++++++++++++------
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1734efad..eacf1e04 100755
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -5,11 +5,13 @@
 * **Notable Fixes:**
     * fixed recursive calls in PIPE
     * the "length of list" block no longer appears twice in search results
+    * prevent inserting items at non-integer / out-of-bounds indices
 
 ### 2021-03-09
 * new dev version
 * objects: fixed #2797
-* fixed recursive calls in PIPE 
+* fixed recursive calls in PIPE
+* lists: prevent usage of lists as dictionaries
 
 ## 6.7.0
 * **New Features:**
diff --git a/snap.html b/snap.html
index 0c0f97d9..348f6f1c 100755
--- a/snap.html
+++ b/snap.html
@@ -13,7 +13,7 @@
         <script src="src/objects.js?version=2021-03-09"></script>
         <script src="src/gui.js?version=2021-03-09"></script>
         <script src="src/paint.js?version=2020-05-17"></script>
-        <script src="src/lists.js?version=2021-02-20"></script>
+        <script src="src/lists.js?version=2021-03-09"></script>
         <script src="src/byob.js?version=2021-03-05"></script>
         <script src="src/tables.js?version=2021-03-05"></script>
         <script src="src/sketch.js?version=2020-07-13"></script>
diff --git a/src/lists.js b/src/lists.js
index d7c307ce..b541efc8 100644
--- a/src/lists.js
+++ b/src/lists.js
@@ -63,7 +63,7 @@ MorphicPreferences, TableDialogMorph, SpriteBubbleMorph, SpeechBubbleMorph,
 TableFrameMorph, TableMorph, Variable, isSnapObject, Costume, contains, detect,
 ZERO, WHITE*/
 
-modules.lists = '2021-February-20';
+modules.lists = '2021-March-09';
 
 var List;
 var ListWatcherMorph;
@@ -192,7 +192,7 @@ List.prototype.add = function (element, index) {
     insert the element before the given slot index,
     if no index is specifed, append the element
 */
-    var idx = index || this.length() + 1,
+    var idx = Math.round(+index) || this.length() + 1,
         obj = isNil(element) ? null : element;
 
     this.becomeArray();
@@ -202,19 +202,23 @@ List.prototype.add = function (element, index) {
 
 List.prototype.put = function (element, index) {
     // exchange the element at the given slot for another
-    var data = element === 0 ? 0
+    var idx = Math.round(+index) || 0,
+        data = element === 0 ? 0
             : element === false ? false
                     : element || null;
 
     this.becomeArray();
-    this.contents[index - 1] = data;
+    if (idx < 1 || idx > this.contents.length) {
+        return;
+    }
+    this.contents[idx - 1] = data;
     this.changed();
 };
 
 List.prototype.remove = function (index) {
     // remove the given slot, shortening the list
     this.becomeArray();
-    this.contents.splice(index - 1, 1);
+    this.contents.splice(Math.round(+index || 0) - 1, 1);
     this.changed();
 };
 
@@ -256,7 +260,9 @@ List.prototype.length = function () {
 };
 
 List.prototype.at = function (index) {
-    var value, idx = +index, pair = this;
+    var value,
+        idx = Math.round(+index || 0),
+        pair = this;
     while (pair.isLinked) {
         if (idx > 1) {
             pair = pair.rest;