Experimental - v3 #1426
Experimental - v3 #1426
Conversation
|
Important Review skippedToo many files! 149 files out of 299 files are above the max files limit of 150. You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| cursor = cursor[segment] as Record<string, unknown>; | ||
| } | ||
|
|
||
| cursor[segments[segments.length - 1]] = value; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the prototype pollution risk in assignNestedWhereValue, we must block unsafe key names from being set as object properties. Specifically, we should prevent assigning to property names "__proto__", "constructor", and "prototype" at any nesting level. The best place to do this is in the loop where segment is assigned as a property, and likewise when the last path segment is used for the final assignment. Add a guard to skip (or throw) if any segment equals one of these forbidden names. This ensures that even if path is attacker-controlled, these dangerous property names cannot be assigned deeply into the object, protecting against prototype pollution. All changes should be confined to the assignNestedWhereValue method in packages/api/src/utils/pipes/typeorm-search-filter.pipe.ts.
| @@ -402,13 +402,30 @@ | ||
|
|
||
| for (let index = 0; index < segments.length - 1; index++) { | ||
| const segment = segments[index]; | ||
| if ( | ||
| segment === '__proto__' || | ||
| segment === 'constructor' || | ||
| segment === 'prototype' | ||
| ) { | ||
| // Ignore dangerous keys to prevent prototype pollution | ||
| return; | ||
| } | ||
| if (!this.isPlainObject(cursor[segment])) { | ||
| cursor[segment] = {}; | ||
| } | ||
| cursor = cursor[segment] as Record<string, unknown>; | ||
| } | ||
|
|
||
| cursor[segments[segments.length - 1]] = value; | ||
| const lastSegment = segments[segments.length - 1]; | ||
| if ( | ||
| lastSegment === '__proto__' || | ||
| lastSegment === 'constructor' || | ||
| lastSegment === 'prototype' | ||
| ) { | ||
| // Ignore dangerous keys to prevent prototype pollution | ||
| return; | ||
| } | ||
| cursor[lastSegment] = value; | ||
| } | ||
|
|
||
| private mergeWhereObjects( |
| continue; | ||
| } | ||
|
|
||
| (left as Record<string, unknown>)[key] = value; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the prototype pollution risk, we should ensure that the mergeWhereObjects method does not copy any property named '__proto__', 'constructor', or 'prototype'. Before assigning or recursing into any key/value pair, the code should check whether the key matches any of these reserved names and skip them if so. This modification should occur inside the loop in the mergeWhereObjects function, specifically before any assignment or recursion. No external dependencies are needed; this can be accomplished with a simple conditional statement.
| @@ -416,6 +416,13 @@ | ||
| right: FindOptionsWhere<T>, | ||
| ): FindOptionsWhere<T> { | ||
| for (const [key, value] of Object.entries(right)) { | ||
| if ( | ||
| key === '__proto__' || | ||
| key === 'constructor' || | ||
| key === 'prototype' | ||
| ) { | ||
| continue; | ||
| } | ||
| if (value === undefined) { | ||
| continue; | ||
| } |
…hook fix(frontend): Optimize useRemoteI18n hook
…ions-hook fix(frontend): Optimize useUserPermissions hook
fix(frontend): Update TanStack Query cache values
fix(frontend): add TanStack useQuery callback functions
Feat/monolith mode build
fix(frontend): resolve hotreload detection logic
…endering fix(frontend): disable update settings rendering
fix(frontend): optimize updateBlock triggered by viewPort
…faultvalues fix(api): update entities object defaultValues
fix(frontend): resolve useFind rendering bugs
fix: remove cache prepare
…e-query-pipe fix(api): remove sanitizeQuery pipe
fix(api): update initiator spelling
fix(api): remove unnecessary BaseOrmService repository type
fix(agentic): add agentic actions type
fix(api): add workflow actions endpoint
…hook feat(frontend): add useQueryChange hook
…-safe-callback-hooks feat(frontend): add useSafeMemo and useSafeCallback hooks
refactor(frontend): enhance yaml visual editor logic
feat: remove memory from the lib
…mponent refactor(frontend): enhance animation icons logic
…fset-zoom-direction feat: save workflow zoom, x, y and direction
Feat/workflow memory
feat: workflow node components
Motivation
The following PR introduces major updates :
Todo
Type of change:
Please delete options that are not relevant.
Checklist: