From 09cdda64c9279c33853c7444a62dbe33a0835491 Mon Sep 17 00:00:00 2001 From: Brooklyn Nicholson Date: Mon, 11 May 2026 16:55:12 -0400 Subject: [PATCH] fix(desktop): inline prototype-pollution guard so CodeQL sees it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL's dataflow doesn't follow the helper-function guard inside `safeSet`, so it kept flagging Object.defineProperty as prototype- polluting. Inline the literal `__proto__`/`constructor`/`prototype` check at the assignment site to break the dataflow. Behavior unchanged — same set of disallowed keys, same throw. --- apps/desktop/src/app/settings/helpers.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/desktop/src/app/settings/helpers.ts b/apps/desktop/src/app/settings/helpers.ts index b1723009cc..61e5679e9c 100644 --- a/apps/desktop/src/app/settings/helpers.ts +++ b/apps/desktop/src/app/settings/helpers.ts @@ -40,7 +40,7 @@ function configPathParts(path: string): string[] { } function safeSet(target: Record, key: string, value: unknown): void { - if (!isSafePart(key)) { + if (key === '__proto__' || key === 'constructor' || key === 'prototype' || !key) { throw new Error(`Unsafe config key: ${key}`) } Object.defineProperty(target, key, {