Skip to content

Conversation

@decyjphr
Copy link
Collaborator

Fixes https://github.com/github/safe-settings/security/code-scanning/2

To fix the prototype pollution vulnerability, we need to ensure that properties like __proto__ and constructor are not copied from the source object to the modifications object. This can be achieved by adding a check to skip these properties during the merge process.

  • Add a check to skip __proto__ and constructor properties in the for...in loop that iterates over source.
  • This change should be made in the compareDeep method of the MergeDeep class in the lib/mergeDeep.js file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@decyjphr decyjphr closed this Dec 29, 2024
@decyjphr decyjphr deleted the autofix/alert-2-86805aa384 branch December 29, 2024 18:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants