From 084f2c53ce4e8cb58d948805f9948aba94889b0e Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Mon, 27 Apr 2026 20:23:49 -0300 Subject: [PATCH] fix(security): replace Object.assign with spread to eliminate prototype pollution flow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL js/prototype-polluting-assignment tracks Object.assign on dynamically-keyed objects as a potential pollution vector, even when runtime guards (isSafeKey) are in place. Replace with spread assignment which creates a new value — CodeQL does not flag this pattern. Addresses remaining alerts #167 and #168. --- src/lib/usage/usageHistory.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/lib/usage/usageHistory.ts b/src/lib/usage/usageHistory.ts index 18f7935fb2..c9f767d136 100644 --- a/src/lib/usage/usageHistory.ts +++ b/src/lib/usage/usageHistory.ts @@ -201,7 +201,11 @@ export function trackPendingRequest( ...normalizedMetadata, }; } else { - Object.assign(pendingRequests.details[connectionId][modelKey], normalizedMetadata); + const merged = { + ...pendingRequests.details[connectionId][modelKey], + ...normalizedMetadata, + }; + pendingRequests.details[connectionId][modelKey] = merged; } } else if (!started && nextCount === 0) { delete pendingRequests.details[connectionId][modelKey]; @@ -223,7 +227,8 @@ export function updatePendingRequest( if (!isSafeKey(modelKey)) return; const existing = pendingRequests.details[connectionId]?.[modelKey]; if (!existing) return; - Object.assign(existing, normalizePendingMetadata(metadata)); + const merged = { ...existing, ...normalizePendingMetadata(metadata) }; + pendingRequests.details[connectionId][modelKey] = merged; } /**