FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Potential fix for code scanning alert no. 169: Prototype-polluting function by graduta · Pull Request #2894 · AliceO2Group/WebUi · GitHub

Potential fix for code scanning alert no. 169: Prototype-polluting function - #2894

Draft
graduta wants to merge 1 commit into
devfrom
alert-autofix-169
Draft

Potential fix for code scanning alert no. 169: Prototype-polluting function#2894
graduta wants to merge 1 commit into
devfrom
alert-autofix-169

Conversation

graduta commented May 26, 2025

Copy link
Copy Markdown
Member

Potential fix for https://github.com/AliceO2Group/WebUi/security/code-scanning/169

To fix the issue, we need to prevent prototype pollution by validating the keys in the keys array before assigning them to the current object. Specifically:

  1. Block dangerous property names like __proto__ and constructor from being used as keys.
  2. Ensure that only safe keys are processed during the recursive assignment.

This can be achieved by adding a check inside the loop (line 93) to skip any key that matches __proto__ or constructor.


Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…nction

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant


Back | FazBrowse Home | New Git URL