Skip to content

web: v1.1.1#8

Merged
danpung2 merged 2 commits intoproductionfrom
develop
Jan 13, 2026
Merged

web: v1.1.1#8
danpung2 merged 2 commits intoproductionfrom
develop

Conversation

@danpung2
Copy link
Owner

No description provided.

@danpung2 danpung2 merged commit 3d6c4aa into production Jan 13, 2026
11 checks passed
let current = obj;
for (const key of keys) {
if (current === undefined || current === null) return undefined;
current = current[key];

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop Warning

Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant