From b9dc608b1f49eb22fc39e73de541d7e188b445e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebasti=C3=A1n=20Martinez?= Date: Tue, 31 Mar 2026 16:42:52 -0300 Subject: [PATCH] Potential fix for code scanning alert no. 27: Prototype-polluting assignment Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/utils/helpers/DiffUtils.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/utils/helpers/DiffUtils.ts b/src/utils/helpers/DiffUtils.ts index 0f5378d..db4c35b 100644 --- a/src/utils/helpers/DiffUtils.ts +++ b/src/utils/helpers/DiffUtils.ts @@ -207,8 +207,12 @@ export class DiffUtils { ): void { const BLOCKED_KEYS = new Set(["__proto__", "constructor", "prototype"]); const keys = path.split("."); + const lastKey = keys[keys.length - 1]; - if (keys.some((k) => BLOCKED_KEYS.has(k))) return; + // Reject empty paths or any segment that could lead to prototype pollution + if (!lastKey || keys.some((k) => BLOCKED_KEYS.has(k))) { + return; + } let current = obj; @@ -220,7 +224,7 @@ export class DiffUtils { current = current[key] as Record; } - current[keys.at(-1)!] = value; + current[lastKey] = value; } /**