From 966214c5a0afa0eea73a42ac6de508d358c422fa Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sat, 29 Aug 2026 17:52:33 +0200 Subject: [PATCH] fix(player): use hasOwnProperty for the device-status guard CodeQL alert 318 (js/remote-property-injection). setDevices guarded the status_update write with a plain "!prev[msg.deviceId]" truthy check; a deviceId of "__proto__" or "constructor" resolves through the prototype chain to a truthy value, so it would pass the guard despite not being a real known device, letting the spread write a bogus own-property (not actual prototype pollution -- computed keys in object literals use [[DefineOwnProperty]], not the legacy __proto__ setter -- but still corrupts the rendered device list). Use Object.prototype.hasOwnProperty.call for a real own-property check; avoided Object.hasOwn (ES2022, Safari 15.4+) given #649's recent Safari-15.0 compatibility work. Co-Authored-By: Claude Sonnet 5 --- pkg/service/soundtouchweb/static/js/app.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkg/service/soundtouchweb/static/js/app.js b/pkg/service/soundtouchweb/static/js/app.js index 39a1f4dd..5eb871c5 100644 --- a/pkg/service/soundtouchweb/static/js/app.js +++ b/pkg/service/soundtouchweb/static/js/app.js @@ -115,7 +115,11 @@ function App() { } } else if (msg.type === 'status_update' && msg.deviceId) { setDevices(prev => { - if (!prev[msg.deviceId]) return prev; + // Object.prototype.hasOwnProperty, not a plain prev[msg.deviceId] + // truthy check: a deviceId of "__proto__" or "constructor" would + // otherwise resolve through the prototype chain to a truthy value + // and pass the check despite not being a real, known device. + if (!Object.prototype.hasOwnProperty.call(prev, msg.deviceId)) return prev; return { ...prev, [msg.deviceId]: { ...prev[msg.deviceId], status: msg.data },