From ea15850f36bc131f960c011cba4aa38405335d09 Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Sun, 13 Sep 2026 22:45:42 +0200 Subject: [PATCH] Potential fix for code scanning alert no. 8: Prototype-polluting function Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- npm/site/src/configeditor/editor.tsx | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/npm/site/src/configeditor/editor.tsx b/npm/site/src/configeditor/editor.tsx index d2ed7635..84845011 100644 --- a/npm/site/src/configeditor/editor.tsx +++ b/npm/site/src/configeditor/editor.tsx @@ -118,15 +118,26 @@ export function setupConfigEditor( function setPath(obj: any, path: string, value: unknown) { const parts = path.split("."); const blockedKeys = new Set(["__proto__", "constructor", "prototype"]); - if (parts.some((part) => blockedKeys.has(part))) return; + if (parts.length === 0 || parts.some((part) => blockedKeys.has(part))) return; - let cur = obj; + let cur: any = obj; for (let i = 0; i < parts.length - 1; i++) { const p = parts[i]; - if (typeof cur[p] !== "object" || cur[p] === null) cur[p] = {}; + if (blockedKeys.has(p)) return; + if (typeof cur !== "object" || cur === null) return; + + if (!Object.prototype.hasOwnProperty.call(cur, p)) { + cur[p] = Object.create(null); + } else if (typeof cur[p] !== "object" || cur[p] === null) { + cur[p] = Object.create(null); + } cur = cur[p]; } - cur[parts[parts.length - 1]] = value; + + const last = parts[parts.length - 1]; + if (blockedKeys.has(last)) return; + if (typeof cur !== "object" || cur === null) return; + cur[last] = value; } function readField(input: any): unknown {