fix: lib.js security and correctness fixes (#40, #41)

- parsePeers: add hasOwnProperty guard and filter null entries
- findActiveExitNode: add hasOwnProperty guard to for..in loop
- makeExitNodeCommand: handle empty hostname correctly

tailscalectl/lib.js

@@ -1,6 +1,7 @@
 function parsePeers(peerMap) {
     if (!peerMap) return []
     return Object.keys(peerMap).map(function (key) {
+        if (!Object.prototype.hasOwnProperty.call(peerMap, key)) return null
         var p = peerMap[key]
         return {
             hostname: p.HostName || key,
@@ -8,16 +9,20 @@ function parsePeers(peerMap) {
             online: p.Online || false,
             exitNode: p.ExitNodeOption || false
         }
-    })
+    }).filter(function (peer) { return peer !== null })
 }
 
 function makeExitNodeCommand(hostname) {
+    if (hostname === "") {
+        return ["tailscale", "set", "--exit-node="]
+    }
     return ["tailscale", "set", "--exit-node=" + hostname]
 }
 
 function findActiveExitNode(peerMap) {
     if (!peerMap) return ""
     for (const key in peerMap) {
+        if (!Object.prototype.hasOwnProperty.call(peerMap, key)) continue
         const p = peerMap[key]
         if (p.ExitNode) {
             return p.HostName || key