-
-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(repo): switch from pnpm to bun #227
Conversation
Here's the code health analysis summary for commits Analysis Summary
|
@@ -38,6 +38,9 @@ | |||
const account = accounts[networkId]?.[address] ?? {} | |||
set( | |||
produce((state) => { | |||
state.accounts[networkId] = state.accounts[networkId] ?? {} | |||
state.accounts[networkId][address] = |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
library input
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the prototype pollution vulnerability, we need to ensure that the networkId
parameter cannot be used to modify Object.prototype
. One effective way to do this is to validate the networkId
parameter before using it as a key in the state.accounts
object. We can reject any networkId
that matches __proto__
, constructor
, or prototype
.
-
Copy modified lines R22-R24 -
Copy modified lines R40-R42 -
Copy modified lines R58-R60 -
Copy modified lines R76-R78 -
Copy modified lines R91-R93
@@ -21,2 +21,5 @@ | ||
ensureAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
throw new Error('Invalid networkId'); | ||
} | ||
set( | ||
@@ -36,2 +39,5 @@ | ||
setAccountInfo: (networkId, address, accountInfo) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
throw new Error('Invalid networkId'); | ||
} | ||
const { accounts } = get() | ||
@@ -51,2 +57,5 @@ | ||
setTransactions: (networkId, address, transactions) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
throw new Error('Invalid networkId'); | ||
} | ||
const { accounts } = get() | ||
@@ -66,2 +75,5 @@ | ||
addAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
throw new Error('Invalid networkId'); | ||
} | ||
set( | ||
@@ -78,2 +90,5 @@ | ||
removeAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
throw new Error('Invalid networkId'); | ||
} | ||
set( |
@@ -50,6 +53,9 @@ | |||
const account = accounts[networkId]?.[address] ?? {} | |||
set( | |||
produce((state) => { | |||
state.accounts[networkId] = state.accounts[networkId] ?? {} | |||
state.accounts[networkId][address] = |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
library input
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the prototype pollution vulnerability, we need to ensure that the networkId
cannot be set to special property names like __proto__
, constructor
, or prototype
. This can be achieved by adding a check to reject these values before using networkId
as a key in the state.accounts
object.
The best way to fix this without changing existing functionality is to add a validation step for networkId
in each function where it is used. If networkId
is one of the special property names, we can return early or handle the error appropriately.
-
Copy modified lines R22-R24 -
Copy modified lines R40-R42 -
Copy modified lines R58-R60 -
Copy modified lines R76-R78 -
Copy modified lines R91-R93
@@ -21,2 +21,5 @@ | ||
ensureAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
return; | ||
} | ||
set( | ||
@@ -36,2 +39,5 @@ | ||
setAccountInfo: (networkId, address, accountInfo) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
return; | ||
} | ||
const { accounts } = get() | ||
@@ -51,2 +57,5 @@ | ||
setTransactions: (networkId, address, transactions) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
return; | ||
} | ||
const { accounts } = get() | ||
@@ -66,2 +75,5 @@ | ||
addAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
return; | ||
} | ||
set( | ||
@@ -78,2 +90,5 @@ | ||
removeAccount: (networkId, address) => { | ||
if (networkId === '__proto__' || networkId === 'constructor' || networkId === 'prototype') { | ||
return; | ||
} | ||
set( |
Describe changes
Ticket or discussion link
Review checklist
Screenshots