MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-04-17 00:31:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add extra safety checks for proto pollution (#20396)

Browse Source 
Co-authored-by: Gal Zahavi <38544478+galz10@users.noreply.github.com>
This commit is contained in:
Jacob Richman
2026-03-03 16:21:09 -08:00
committed by GitHub
parent 28af4e127f
commit af424aefa9
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
packages/cli/src/utils/deepMerge.test.ts
View File

@@ -152,13 +152,27 @@ describe('customDeepMerge', () => {
});
it('should not pollute the prototype', () => {
const maliciousSource = JSON.parse('{"__proto__": {"polluted": "true"}}');
const maliciousSource = JSON.parse('{"__proto__": {"polluted1": "true"}}');
const getMergeStrategy = () => undefined;
const result = customDeepMerge(getMergeStrategy, {}, maliciousSource);
let result = customDeepMerge(getMergeStrategy, {}, maliciousSource);
expect(result).toEqual({});
// eslint-disable-next-line @typescript-eslint/no-explicit-any
expect(({} as any).polluted).toBeUndefined();
expect(({} as any).polluted1).toBeUndefined();
const maliciousSource2 = JSON.parse(
'{"constructor": {"prototype": {"polluted2": "true"}}}',
);
result = customDeepMerge(getMergeStrategy, {}, maliciousSource2);
expect(result).toEqual({});
// eslint-disable-next-line @typescript-eslint/no-explicit-any
expect(({} as any).polluted2).toBeUndefined();
const maliciousSource3 = JSON.parse('{"prototype": {"polluted3": "true"}}');
result = customDeepMerge(getMergeStrategy, {}, maliciousSource3);
expect(result).toEqual({});
// eslint-disable-next-line @typescript-eslint/no-explicit-any
expect(({} as any).polluted3).toBeUndefined();
});
it('should use additionalProperties merge strategy for dynamic properties', () => {