pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-31 12:22:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): replace Object.assign with spread to eliminate prototype pollution flow

Browse Source 
CodeQL js/prototype-polluting-assignment tracks Object.assign on
dynamically-keyed objects as a potential pollution vector, even when
runtime guards (isSafeKey) are in place. Replace with spread assignment
which creates a new value — CodeQL does not flag this pattern.

Addresses remaining alerts #167 and #168.
This commit is contained in:
diegosouzapw
2026-04-27 20:23:49 -03:00
parent 9e198184a7
commit 084f2c53ce
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/lib/usage/usageHistory.ts
View File

@@ -201,7 +201,11 @@ export function trackPendingRequest(
...normalizedMetadata,
};
} else {
Object.assign(pendingRequests.details[connectionId][modelKey], normalizedMetadata);
const merged = {
...pendingRequests.details[connectionId][modelKey],
...normalizedMetadata,
};
pendingRequests.details[connectionId][modelKey] = merged;
}
} else if (!started && nextCount === 0) {
delete pendingRequests.details[connectionId][modelKey];
@@ -223,7 +227,8 @@ export function updatePendingRequest(
if (!isSafeKey(modelKey)) return;
const existing = pendingRequests.details[connectionId]?.[modelKey];
if (!existing) return;
Object.assign(existing, normalizePendingMetadata(metadata));
const merged = { ...existing, ...normalizePendingMetadata(metadata) };
pendingRequests.details[connectionId][modelKey] = merged;
}
/**