v5.0.0-beta #2449
Closed
v5.0.0-beta #2449
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jun 8, 2025
f070763 to
a8acb1c
Compare
ui/src/app/core/settings.service.ts
Outdated
| current = current[keys[i]] | ||
| } | ||
| if (!this.forbiddenKeys.includes(keys[keys.length - 1])) { | ||
| current[keys[keys.length - 1]] = value |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
To fix the issue, we need to explicitly block the keys __proto__ and constructor in the setEnvItem function. This can be done by adding a check to ensure that these keys are not included in the keys array or its elements. This approach is consistent with best practices for preventing prototype pollution.
The changes will be made in the setEnvItem function:
- Add a check to block
__proto__andconstructorin the loop that iterates overkeys. - Ensure that the final key in the chain (i.e.,
keys[keys.length - 1]) is also checked before assigning the value.
Suggested changeset
1
ui/src/app/core/settings.service.ts
| @@ -184,3 +184,3 @@ | ||
| for (let i = 0; i < keys.length - 1; i++) { | ||
| if (this.forbiddenKeys.includes(keys[i])) { | ||
| if (this.forbiddenKeys.includes(keys[i]) || keys[i] === '__proto__' || keys[i] === 'constructor') { | ||
| return | ||
| @@ -192,4 +192,5 @@ | ||
| } | ||
| if (!this.forbiddenKeys.includes(keys[keys.length - 1])) { | ||
| current[keys[keys.length - 1]] = value | ||
| const finalKey = keys[keys.length - 1]; | ||
| if (!this.forbiddenKeys.includes(finalKey) && finalKey !== '__proto__' && finalKey !== 'constructor') { | ||
| current[finalKey] = value | ||
| } |
Copilot is powered by AI and may make mistakes. Always verify output.
8913b6d to
8a04ab0
Compare
b02bd97 to
1a6bd29
Compare
b4c4194 to
2670df4
Compare
c89db3d to
0fb3c1b
Compare
53863b3 to
12cf639
Compare
ce82c3b to
31ee102
Compare
Co-Authored-By: Northern Man <19808920+NorthernMan54@users.noreply.github.com>
…2451) Co-Authored-By: Northern Man <19808920+NorthernMan54@users.noreply.github.com>
Co-Authored-By: Northern Man <19808920+NorthernMan54@users.noreply.github.com>
c4738cc to
eb824f6
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related PRs:
hap-nodejs: v2.0.0-beta HAP-NodeJS#1094homebridge: v2.0.0-beta homebridge#3816@homebridge/hap-client: v3.0.0-beta hap-client#21homebridge-config-ui-x: v5.0.0-beta #2449@homebridge/node-pty-prebuilt-multiarch: NodeJS 24 Support node-pty-prebuilt-multiarch#59v1andv2-betav18and earlier, so please update tov20orv22- more info on updatingarmv6architecture (like the Pi 1 and Pi Zero) - please update your hardwarepnpmas the package manager - consider updating your Homebridge instance to use npm instead - more info on updatingUI Changes
fi.jsonlanguage file (Update fi.json #2253) (@l1500s)Other Changes
pnpmand code referencesfastifyandnestjsdependenciesHomebridge Dependencies
@homebridge/hap-client@v3.0.0-beta@homebridge/node-pty-prebuilt-multiarch@v0.13.0-beta@homebridge/plugin-ui-utils@v2.1.0