René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][store] deepClone does not guard __proto__ key → clone prototype reassignment","articleBody":"## Severity: 🟢 Low (robustness)\n\n## Location\n[`src/store/utils.ts:43-47`](../blob/main/src/store/utils.ts#L43-L47) (`deepClone`), consumed by `$patchDeep` ([`src/store/create-store.ts:429-443`](../blob/main/src/store/create-store.ts#L429-L443)).\n\n## Description\nUnlike [`src/core/utils/object.ts`](../blob/main/src/core/utils/object.ts) (which guards prototype-pollution keys), the store's `deepClone` assigns via bracket notation over `Object.keys`:\n```ts\ncloned[key] = deepClone(source[key]);\n```\nA state object with an own enumerable `__proto__` key (e.g. produced by `JSON.parse('{\"__proto__\":{…}}')`) triggers the `__proto__` setter, reassigning the **clone's** prototype rather than copying a data property. This is contained (it does not pollute global `Object.prototype`) but corrupts the cloned object used by `$patchDeep`. A fidelity/robustness bug rather than a global pollution vector.\n\n## Suggested fix\nSkip prototype-pollution keys (reuse `isPrototypePollutionKey` from `object.ts`), or assign with `Object.defineProperty(cloned, key, { value, enumerable: true, writable: true, configurable: true })`.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:43.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/175/bQuery/issues/175"}