Merge pull request #102 from yubin-jee/devin/1772171680-fix-remote-property-injection-admin

fix: remediate js/remote-property-injection in src/routes/admin.js

Author: yubin-jee

src/routes/admin.js

@@ -51,11 +51,16 @@ router.post('/import-config', (req, res) => {
   });
 });
 
-// VULN: Prototype pollution via merge (CWE-1321)
+// Secure settings update with property injection prevention
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 router.post('/update-settings', (req, res) => {
   const userSettings = req.body;
-  const settings = {};
+  const settings = Object.create(null);
   Object.keys(userSettings).forEach(key => {
+    if (DANGEROUS_KEYS.has(key)) {
+      return; // skip dangerous property names to prevent prototype pollution
+    }
     settings[key] = userSettings[key];
   });
   res.json({ settings });