Tom Boucher dcc7bc0d15 fix(#1406): guard setGsdConfig test helper against prototype pollution (#1407) ...

CodeQL js/prototype-pollution-utility (alert #40) flagged the setGsdConfig
test helper in tests/git-base-branch.test.cjs: it deep-assigns through a
dot-split key chain with no __proto__/constructor/prototype guard (CWE-915).

Mirror the production guard in src/config.cts (PR #752): inline literal
__proto__/prototype/constructor checks immediately before both write sites,
throwing on a forbidden segment. This is the form CodeQL recognizes; a
Set/pre-loop guard is not. Add a #1406 regression suite asserting the guard
throws on malicious keys and does not pollute Object.prototype, while a normal
nested key still writes. Behavior unchanged for the existing call (16/16 pass).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-17 21:51:02 -04:00

17 KiB

Raw Blame History

View Raw