Skip to content

Harden tool dispatch against inherited properties - #2

Merged
noah-ing merged 1 commit into
mainfrom
fix/codeql-object-prototype
Aug 20, 2026
Merged

Harden tool dispatch against inherited properties#2
noah-ing merged 1 commit into
mainfrom
fix/codeql-object-prototype

Conversation

@noah-ing

Copy link
Copy Markdown
Owner

Summary

  • require tool implementations to be own properties before dispatch
  • reject inherited Object.prototype names with unknown_tool
  • add regression coverage and replace the test-only script regex flagged by CodeQL

Verification

  • node --test test/tools.test.mjs (18/18)
  • node --test edge/test/worker.test.mjs (21/21)
  • git diff --check
  • required CI and CodeQL must pass before merge

Closes the remaining actionable CodeQL alert.

@noah-ing
noah-ing merged commit eaf15f0 into main Aug 20, 2026
4 checks passed
@noah-ing
noah-ing deleted the fix/codeql-object-prototype branch August 20, 2026 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant