[FIX] Add guard against prototype pollution (#960)

JIRA: CPOUI5FOUNDATION-728 fixes: https://github.com/SAP/ui5-builder/security/code-scanning/19 Details: https://codeql.github.com/codeql-query-help/javascript/js-prototype-pollution-utility
SAP · Nov 24, 2023 · ba230d9 · ba230d9
1 parent 50bb0d9
commit ba230d9
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/processors/jsdoc/lib/ui5/template/publish.cjs b/lib/processors/jsdoc/lib/ui5/template/publish.cjs
@@ -89,6 +89,10 @@ function merge(target, source) {
 	if ( source != null ) {
 		// simple single source merge
 		Object.keys(source).forEach((prop) => {
+			// guarding against prototype pollution. (https://codeql.github.com/codeql-query-help/javascript/js-prototype-pollution-utility/#example)
+			if (prop === "__proto__" || prop === "constructor") {
+				return;
+			}
 			const value = source[prop];
 			if ( value != null && value.constructor === Object ) {
 				merge(target[prop] || {}, value);