test(utils): Add prototype pollution regression tests#2870
Conversation
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces regression tests in pp-check.spec.ts to prevent prototype pollution vulnerabilities in lodashUtil.merge and lodashUtil.mergeWith. The feedback suggests enhancing test coverage by adding a constructor.prototype pollution test for mergeWith and unifying the assertions to explicitly check Object.prototype across all test cases.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
- Add `pp-check.spec.ts` to guard `lodash-adapter` merge functions - Verify `merge` and `mergeWith` ignore `__proto__` payloads - Verify `constructor.prototype` payloads do not pollute `Object.prototype` - Ensure legitimate deep merging still works as expected Signed-off-by: mingcheng <mingcheng@apache.org>
mingcheng
force-pushed
the
chore/add-prototype-pollution-tests
branch
from
be12b3e to
3924c1b
Compare
1 participant
改动描述
pp-check.spec.tsto guardlodash-adaptermerge functionsmergeandmergeWithignore__proto__payloadsconstructor.prototypepayloads do not polluteObject.prototype🤔 这个变动的性质是？
🔗 相关 Issue
#2861
💡 需求背景和解决方案
📝 更新日志
☑️ 请求合并前的自查清单