chore: apply AI code review suggestions

Apply suggestions from cubic, gemini, and copilot review threads on
PR #364:

- Use `Object.hasOwn(vercelJson, key)` instead of `key in vercelJson`
  so prototype-chain properties cannot leak into projectSettings even if
  upstream code mutates Object.prototype (cubic, copilot).
- Type-guard whitelisted vercel.json values: only string and null pass
  through to projectSettings. Other types surface a local warning
  instead of producing a 400 from the Vercel API (gemini).

Add tests for both behaviors: explicit null sentinel preservation and
rejection of non-string/non-null values.

Refs #359, PR #364

Author: amondnet

dist/index.js

@@ -102556,12 +102556,19 @@ function buildProjectConfig(config) {
     const projectSettings = {};
     if (vercelJson) {
         for (const key of PROJECT_SETTINGS_KEYS) {
-            if (key in vercelJson) {
-                // The Vercel REST API validates each value type itself. We only
-                // copy whitelisted keys, so prototype-pollution gadgets in
-                // vercel.json (`__proto__`, `constructor`, ...) cannot reach
-                // projectSettings.
-                projectSettings[key] = vercelJson[key];
+            if (Object.hasOwn(vercelJson, key)) {
+                // Whitelist + own-property check keeps prototype-pollution gadgets
+                // (`__proto__`, `constructor`, ...) out of projectSettings. The
+                // value-type guard rejects unexpected shapes (numbers, booleans,
+                // arrays) before the Vercel API validator sees them, surfacing a
+                // local warning instead of a 400 from the deployment endpoint.
+                const value = vercelJson[key];
+                if (typeof value === 'string' || value === null) {
+                    projectSettings[key] = value;
+                }
+                else {
+                    core.warning(`Ignoring vercel.json "${key}" — expected string or null, got ${typeof value === 'object' ? (Array.isArray(value) ? 'array' : 'object') : typeof value}.`);
+                }
             }
         }
     }

dist/index.js.map

@@ -269,6 +269,44 @@ describe('buildProjectConfig', () => {
     expect(result.projectSettings?.sourceFilesOutsideRootDirectory).toBeUndefined()
   })
 
+  it('preserves explicit null values for whitelisted keys (Vercel "use default" sentinel)', () => {
+    // The Vercel REST API treats `null` and `undefined` differently: omission
+    // means "keep current project setting", null means "explicit override to
+    // no command". The action must preserve null verbatim.
+    writeFileSync(
+      path.join(tmpDir, 'vercel.json'),
+      JSON.stringify({ buildCommand: null, framework: 'hugo' }),
+    )
+
+    const result = buildProjectConfig(createConfig({ workingDirectory: tmpDir }))
+
+    expect(result.projectSettings?.buildCommand).toBeNull()
+    expect(result.projectSettings?.framework).toBe('hugo')
+  })
+
+  it('rejects non-string/non-null values for whitelisted keys without sending them to the API', () => {
+    // Defensive guard: a user with a malformed vercel.json (e.g. `framework: 42`)
+    // should get a local warning rather than a 400 from the deployment endpoint.
+    writeFileSync(
+      path.join(tmpDir, 'vercel.json'),
+      JSON.stringify({
+        buildCommand: 42,
+        installCommand: true,
+        outputDirectory: ['dist'],
+        framework: { name: 'nextjs' },
+        devCommand: 'dev',
+      }),
+    )
+
+    const result = buildProjectConfig(createConfig({ workingDirectory: tmpDir }))
+
+    expect(result.projectSettings).not.toHaveProperty('buildCommand')
+    expect(result.projectSettings).not.toHaveProperty('installCommand')
+    expect(result.projectSettings).not.toHaveProperty('outputDirectory')
+    expect(result.projectSettings).not.toHaveProperty('framework')
+    expect(result.projectSettings?.devCommand).toBe('dev')
+  })
+
   it('does not copy images, redirects, or other non-whitelisted vercel.json keys into projectSettings', () => {
     writeFileSync(
       path.join(tmpDir, 'vercel.json'),

src/__tests__/project-config.test.ts

@@ -130,12 +130,21 @@ export function buildProjectConfig(config: ActionConfig): ProjectConfig {
 
   if (vercelJson) {
     for (const key of PROJECT_SETTINGS_KEYS) {
-      if (key in vercelJson) {
-        // The Vercel REST API validates each value type itself. We only
-        // copy whitelisted keys, so prototype-pollution gadgets in
-        // vercel.json (`__proto__`, `constructor`, ...) cannot reach
-        // projectSettings.
-        projectSettings[key] = vercelJson[key] as string | null
+      if (Object.hasOwn(vercelJson, key)) {
+        // Whitelist + own-property check keeps prototype-pollution gadgets
+        // (`__proto__`, `constructor`, ...) out of projectSettings. The
+        // value-type guard rejects unexpected shapes (numbers, booleans,
+        // arrays) before the Vercel API validator sees them, surfacing a
+        // local warning instead of a 400 from the deployment endpoint.
+        const value = vercelJson[key]
+        if (typeof value === 'string' || value === null) {
+          projectSettings[key] = value
+        }
+        else {
+          core.warning(
+            `Ignoring vercel.json "${key}" — expected string or null, got ${typeof value === 'object' ? (Array.isArray(value) ? 'array' : 'object') : typeof value}.`,
+          )
+        }
       }
     }
   }