fix(utils): prevent prototype pollution in deepExtend

[lahirumaramba]

Prevent prototype pollution in deepExtend

[gemini-code-assist]

Code Review

This pull request adds a security check to the deepExtend function in src/utils/deep-copy.ts to prevent prototype pollution by skipping __proto__, constructor, and prototype properties. The feedback suggests adding unit tests to verify that these prototype pollution vectors are successfully blocked and to prevent future regressions.

[lahirumaramba]

/gemini review

[gemini-code-assist]

Code Review

This pull request adds prototype pollution protection to the deepExtend utility by ignoring the __proto__, constructor, and prototype properties, along with corresponding unit tests. Feedback suggests addressing a related security and correctness risk where deepExtend recursively mutates properties inherited by the target from its prototype chain. It is recommended to check if a property is an own property of the target before extending it, and to add a unit test verifying that inherited prototype properties are not mutated.

[lahirumaramba]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces prototype pollution protection in the deepExtend utility by ignoring __proto__, constructor, and prototype properties, and adds a comprehensive suite of unit tests. The review feedback highlights an issue where using target instanceof Object fails for objects created via Object.create(null), and suggests a safer type check along with an additional unit test to cover this case.

[lahirumaramba]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the deepExtend utility in src/utils/deep-copy.ts to prevent prototype pollution by skipping sensitive properties (__proto__, constructor, and prototype) and checking property existence on the target. It also adds comprehensive unit tests to verify deep copying, merging, and prototype pollution prevention. Feedback on the changes suggests that blocking the 'constructor' property is redundant and limits legitimate use cases, as prototype pollution via 'constructor' is already mitigated by other checks in the implementation.

[yvonnep165]

LGTM!