fix(nested-obj): guard against prototype pollution in path traversal

packages/nested-obj/__tests__/options.test.ts

@@ -57,6 +57,34 @@ describe('Object Path Operations', () => {
     });
   });
 
+  describe('prototype pollution protection', () => {
+    it('should throw on __proto__ path segment in set', () => {
+      expect(() => objectPath.set(obj, '__proto__.polluted', 'yes')).toThrow('Unsafe path segment: __proto__');
+      expect(({} as any).polluted).toBeUndefined();
+    });
+
+    it('should throw on constructor path segment in set', () => {
+      expect(() => objectPath.set(obj, 'constructor.polluted', 'yes')).toThrow('Unsafe path segment: constructor');
+    });
+
+    it('should throw on prototype path segment in set', () => {
+      expect(() => objectPath.set(obj, 'prototype.polluted', 'yes')).toThrow('Unsafe path segment: prototype');
+    });
+
+    it('should throw on __proto__ path segment in get', () => {
+      expect(() => objectPath.get(obj, '__proto__.polluted')).toThrow('Unsafe path segment: __proto__');
+    });
+
+    it('should throw on __proto__ path segment in has', () => {
+      expect(() => objectPath.has(obj, '__proto__.polluted')).toThrow('Unsafe path segment: __proto__');
+    });
+
+    it('should throw on nested unsafe path segments', () => {
+      expect(() => objectPath.set(obj, 'user.__proto__.polluted', 'yes')).toThrow('Unsafe path segment: __proto__');
+      expect(() => objectPath.set(obj, 'user.constructor.polluted', 'yes')).toThrow('Unsafe path segment: constructor');
+    });
+  });
+
   describe('has', () => {
     it('should return true if a path exists', () => {
       expect(objectPath.has(obj, 'user.name')).toBe(true);

packages/nested-obj/src/index.ts

@@ -1,6 +1,18 @@
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+function parsePath(path: string): string[] {
+  const keys = path.replace(/\[(\w+)\]/g, '.$1').split('.');
+  for (const key of keys) {
+    if (UNSAFE_KEYS.has(key)) {
+      throw new Error('Unsafe path segment: ' + key);
+    }
+  }
+  return keys;
+}
+
 export default {
   get<T>(obj: Record<string, any>, path: string): T | undefined {
-    const keys = path.replace(/\[(\w+)\]/g, '.$1').split('.');
+    const keys = parsePath(path);
     let result: any = obj;
     for (const key of keys) {
       if (result == null) {
@@ -16,7 +28,7 @@ export default {
       return;
     }
 
-    const keys = path.replace(/\[(\w+)\]/g, '.$1').split('.');
+    const keys = parsePath(path);
     let current = obj;
     for (let i = 0; i < keys.length - 1; i++) {
       const key = keys[i];
@@ -29,7 +41,7 @@ export default {
   },
 
   has(obj: Record<string, any>, path: string): boolean {
-    const keys = path.replace(/\[(\w+)\]/g, '.$1').split('.');
+    const keys = parsePath(path);
     let current = obj;
     for (const key of keys) {
       if (current == null || !(key in current)) {