WIP - insert many with generated embeddings #688
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
gagik
force-pushed
the
gagik/accuracy-embeddings
branch
from
9326ed4 to
3bf73da
Compare
|
|
||
| const lastPart = parts[parts.length - 1]; | ||
| if (lastPart) { | ||
| current[lastPart] = value; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 21 hours ago
To fix this vulnerability, we need to prevent untrusted property chains from traversing or assigning to dangerous property names such as "__proto__", "constructor", and "prototype". The single best way to accomplish this without affecting existing functionality is to skip any assignment where any element in the parts array matches these restricted names. Modify the loop in setFieldValue so that it continues (i.e., skips) upon encountering such property names in the chain, both when traversing intermediate objects and at the final assignment. This is a minimal, targeted fix. All changes occur in the setFieldValue method of InsertManyTool in src/tools/mongodb/create/insertMany.ts. No external libraries required.
| @@ -211,10 +211,10 @@ | ||
| private setFieldValue(document: Document, path: string, value: unknown): void { | ||
| const parts = path.split("."); | ||
| let current: Record<string, unknown> = document; | ||
|
|
||
| const dangerousProperties = ["__proto__", "constructor", "prototype"]; | ||
| for (let i = 0; i < parts.length - 1; i++) { | ||
| const part = parts[i]; | ||
| if (!part) { | ||
| if (!part || dangerousProperties.includes(part)) { | ||
| continue; | ||
| } | ||
| if (!(part in current) || typeof current[part] !== "object") { | ||
| @@ -224,7 +222,7 @@ | ||
| } | ||
|
|
||
| const lastPart = parts[parts.length - 1]; | ||
| if (lastPart) { | ||
| if (lastPart && !dangerousProperties.includes(lastPart)) { | ||
| current[lastPart] = value; | ||
| } | ||
| } |
1 participant
Do not review.
This is still very WIP and not ready for review, just running accuracy tests.