fix(web): harden config PATCH allowlists against prototype-chain keys

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-13 15:06:49 +02:00
parent 6decdc7fc9
commit bbe1616ed2
5 changed files with 20 additions and 5 deletions
@@ -26,7 +26,7 @@ export async function PATCH(request: Request) {
    return Response.json({ error: "invalid JSON" }, { status: 400 });
  }
  const entries = Object.entries((body ?? {}) as Record<string, unknown>).filter(
-    ([k]) => k in DEFAULTS,
+    ([k]) => Object.prototype.hasOwnProperty.call(DEFAULTS, k),
  );
  for (const [key, value] of entries) {
    await prisma.config.upsert({