fix: block prototype pollution in merge-allof-schema-properties.js

[anupamme]

The mergeAllOfSchemaProperties function uses lodash's mergeWith to merge OpenAPI schema objects without validating property names. An attacker who can supply a malicious OpenAPI document with 'proto', 'constructor', or 'prototype' property names can pollute Object.prototype, affecting all JavaScript objects in the application runtime. The affected code is packages/ruleset/src/utils/merge-allof-schema-properties.js:1, and this change addresses it.

Reference: CWE-1321

What changed

• packages/ruleset/src/utils/merge-allof-schema-properties.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

const { mergeAllOfSchemaProperties } = require('./packages/ruleset/src/utils/merge-allof-schema-properties.js');

describe("mergeAllOfSchemaProperties must not pollute Object.prototype", () => {
  const payloads = [
    { allOf: [{ __proto__: { polluted: true } }] },
    { allOf: [{ constructor: { prototype: { polluted: true } } }] },
    { allOf: [{ type: 'string' }, { description: 'valid' }] },
  ];

  beforeEach(() => {
    delete Object.prototype.polluted;
  });

  test.each(payloads)("prevents prototype pollution for input: %j", (payload) => {
    mergeAllOfSchemaProperties(payload);
    expect(Object.prototype.polluted).toBeUndefined();
  });
});