fix(web): harden config PATCH allowlists against prototype-chain keys

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-13 15:06:49 +02:00
parent 6decdc7fc9
commit bbe1616ed2
5 changed files with 20 additions and 5 deletions
@@ -26,4 +26,11 @@ describe("monitor config API", () => {
    expect(body["monitor.pollIntervalHours"]).toBe("12");
    expect(await prisma.config.findUnique({ where: { key: "nope" } })).toBeNull();
  });
+
+  it("ignores prototype-chain keys (__proto__, constructor) and writes no Config row", async () => {
+    const before = await prisma.config.count();
+    const res = await patch({ __proto__: "x", constructor: "y" });
+    expect((await res.json()).updated).toBe(0);
+    expect(await prisma.config.count()).toBe(before);
+  });
 });