T09 · Insecure Skill Coding Practices
Warning
- Location
src/pipeline.js:328- Finding
Unsafe Dynamic Property Keys Enable Object Prototype Manipulation and Denial of Service
- Content
View full analysis
{ const result = { ...item }; for (const [oldName, newName] of Object.entries(fieldMap)) { if (result[oldName] !== undefined) { result[newName] = result[oldName]; delete result[oldName]; } } return result; }); } const result = { ...data }; for (const [oldName, newName] of Object.entries(fieldMap)) { if (result[oldName] !== undefined) { result[newName] = result[oldName]; delete result[oldName]; } } return result; ``` #### Merge lookup, lines 462–471 ```javascript const lookup = {}; for (const source of sources) { for (const item of source) { const key = item[joinKey]; if (key !== undefined) lookup[key] = { ...lookup[key], ...item }; } } return data.map(item => { const key = item[joinKey]; return key !== undefined ? { ...item, ...(lookup[key] || {}) } : { ...item }; }); ``` #### Default-field assignment, lines 608–614 ```javascript const result = { ...item }; for (const [field, defaultValue] of Object.entries(fieldDefaults)) { if (result[field] === undefined || result[field ...[truncated 4280 chars]- Remediation
View remediation