Skip to content

Harden nested object path lookups#16419

Merged
matthewp merged 3 commits intomainfrom
semgrep-object-path-hardening
Apr 22, 2026
Merged

Harden nested object path lookups#16419
matthewp merged 3 commits intomainfrom
semgrep-object-path-hardening

Conversation

@matthewp
Copy link
Copy Markdown
Contributor

@matthewp matthewp commented Apr 20, 2026

Changes

  • Blocks prototype-like keys when traversing action handlers, user preferences, and MDX frontmatter so nested lookups stop at unsafe property names.
  • Switches vary-header storage to a null-prototype map and updates create-astro package JSON rewriting to avoid broad object merging.

Testing

  • Installed dependencies in a fresh worktree to validate the split branch in isolation.
  • Ran Biome against the touched source files and changeset to confirm the branch stays formatted and lint-clean.

Docs

  • No docs update needed, because this is internal hardening for existing code paths.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 20, 2026 •
edited
Loading

🦋 Changeset detected

Latest commit: d2a5e34

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions Bot added feat: markdown Related to Markdown (scope) pkg: create-astro Related to the `create-astro` package (scope) pkg: astro Related to the core `astro` package (scope) labels Apr 20, 2026
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Apr 20, 2026 •
edited
Loading

Merging this PR will not alter performance

✅ 18 untouched benchmarks

Comparing semgrep-object-path-hardening (d2a5e34) with main (471a4d6)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (f7566b8) during the generation of this report, so 471a4d6 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

ematipico
ematipico requested changes Apr 21, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@ematipico ematipico left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's avoid repetition of the same thing

Comment thread packages/astro/src/core/cache/memory-provider.ts
Comment thread packages/astro/src/preferences/dlv.ts Outdated
@@ -1,7 +1,12 @@
const FORBIDDEN_PATH_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
Copy link
Copy Markdown
Member

@ematipico ematipico Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't repeat the same object. Maybe move it inside internal-helpers so we can always use the same set.

Copy link
Copy Markdown
Contributor Author

@matthewp matthewp Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved this into @astrojs/internal-helpers/object

ematipico
ematipico approved these changes Apr 22, 2026
View reviewed changes
Comment thread .changeset/harden-object-path-lookups.md Outdated
@matthewp @ematipico
Update .changeset/harden-object-path-lookups.md
d2a5e34 
Co-authored-by: Emanuele Stoppa <estoppa@cloudflare.com>
@matthewp matthewp merged commit f3485c3 into main Apr 22, 2026
27 checks passed
@matthewp matthewp deleted the semgrep-object-path-hardening branch April 22, 2026 14:38
@astrobot-houston astrobot-houston mentioned this pull request Apr 22, 2026
Merged
dadezzz pushed a commit to dadezzz/university_notes that referenced this pull request Apr 26, 2026
@dadezzz
fix(deps): update dependency astro to v6.1.9 (#592)
6716474 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.8` → `6.1.9`](https://renovatebot.com/diffs/npm/astro/6.1.8/6.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.8/6.1.9?slim=true) |

---

### Release Notes

<details>
<summary>withastro/astro (astro)</summary>

### [`v6.1.9`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#619)

[Compare Source](https://github.com/withastro/astro/compare/astro@6.1.8...astro@6.1.9)

##### Patch Changes

- [#&#8203;16448](withastro/astro#16448) [`99464ed`](withastro/astro@99464ed) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Updates vite, picomatch, and unstorage to latest patch versions

- [#&#8203;16422](withastro/astro#16422) [`a3951d7`](withastro/astro@a3951d7) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens `astro-island` export resolution and hydration error handling for malformed component metadata

- [#&#8203;16420](withastro/astro#16420) [`e21de1d`](withastro/astro@e21de1d) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

- [#&#8203;16419](withastro/astro#16419) [`f3485c3`](withastro/astro@f3485c3) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

- [#&#8203;16022](withastro/astro#16022) [`a002540`](withastro/astro@a002540) Thanks [@&#8203;mathieumaf](https://github.com/mathieumaf)! - Fixes an issue where i18n domains would return 404 when `trailingSlash` is set to `never`.

- Updated dependencies \[[`99464ed`](withastro/astro@99464ed), [`f3485c3`](withastro/astro@f3485c3)]:
  - [@&#8203;astrojs/internal-helpers](https://github.com/astrojs/internal-helpers)@&#8203;0.9.0
  - [@&#8203;astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@&#8203;7.1.1

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
@github-actions github-actions Bot mentioned this pull request Apr 27, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ematipico ematipico ematipico approved these changes

Assignees

No one assigned

Labels

feat: markdown Related to Markdown (scope) pkg: astro Related to the core `astro` package (scope) pkg: create-astro Related to the `create-astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthewp @ematipico