vrr/qwen-code
2
0
Fork 0
mirror of https://github.com/QwenLM/qwen-code.git synced 2026-05-23 12:44:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix(cli): guard mock setValue against prototype pollution in adapter test

Browse source 
CodeQL flagged the mock setValue's recursive property assignment as a prototype-pollution sink. Add UNSAFE_KEY_PARTS check at the top of the mock to align with the real setNestedPropertySafe contract.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
This commit is contained in:
pomelo-nwu 2026-05-19 15:41:35 +08:00
parent 0fe8ad67bc
commit 2e6adf8a6d
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
packages/cli/src/config/loadedSettingsAdapter.test.ts
View file

@ -43,9 +43,19 @@ function makeSettings(initial: SettingsShape = {}) {
originalSettings: structuredClone(initial),
path: '/tmp/qwen-test-settings.json',
};
// Mirror the real LoadedSettings/setNestedPropertySafe contract: any caller
// that slipped a `__proto__` / `constructor` / `prototype` segment past the
// adapter-layer guard would have its write rejected here too. The adapter
// already short-circuits these (see the test below), but guarding the mock
// keeps it semantically aligned with the production helper and quiets
// CodeQL's prototype-pollution scanner on the mock fixture itself.
const UNSAFE_KEY_PARTS = new Set(['__proto__', 'constructor', 'prototype']);
const setValue = vi.fn(
(_scope: SettingScope, key: string, value: unknown) => {
const parts = key.split('.');
if (parts.some((p) => UNSAFE_KEY_PARTS.has(p))) {
throw new Error(`mock setValue refused reserved segment in: ${key}`);
}
let current: Record<string, unknown> = file.settings as Record<
string,
unknown