Skip to content

Conversation

@graduta
Copy link
Member

@graduta graduta commented May 26, 2025

Potential fix for https://github.com/AliceO2Group/WebUi/security/code-scanning/169

To fix the issue, we need to prevent prototype pollution by validating the keys in the keys array before assigning them to the current object. Specifically:

  1. Block dangerous property names like __proto__ and constructor from being used as keys.
  2. Ensure that only safe keys are processed during the recursive assignment.

This can be achieved by adding a check inside the loop (line 93) to skip any key that matches __proto__ or constructor.


Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…nction

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants