🛡️ Sentinel: [CRITICAL/HIGH] Fix prototype pollution in AI extra body

.jules/sentinel.md

@@ -2,3 +2,7 @@
 **Vulnerability:** API endpoints in `backend/src/server.ts` taking user input (`projectId`, `jobId`) were directly joined with paths using `join` in `backend/src/store/localStore.ts` without proper sanitization. This allowed attackers to escape the project directory context and overwrite or read arbitrary files by sending payload containing `../` sequences.
 **Learning:** Even internal backend services handling project resources must securely sanitize all parameter values used for file operations to prevent path traversal outside expected boundaries.
 **Prevention:** Always use safe path sanitization utilities, like the implemented `safeJoin` and `toSafeRelativePath` in `backend/src/utils/path.ts`, to securely construct file paths and ensure the final path remains within the intended boundaries.
+## 2025-03-05 - [Prototype Pollution in Object Merging]
+**Vulnerability:** A prototype pollution vulnerability existed in `backend/src/services/aiRouter.ts` where properties from user-provided `extraBody` were iteratively copied directly into an object without sanitizing sensitive keys like `__proto__`, `constructor`, and `prototype`.
+**Learning:** Copying properties directly from parsed user input over to internal state objects allows attackers to override prototype attributes, which can result in denial of service, logic bypass, or further vulnerabilities depending on where the polluted object is used.
+**Prevention:** Always explicitly validate and block sensitive keys (`__proto__`, `constructor`, `prototype`) when transferring properties from user-provided input to internal objects to prevent prototype pollution.

backend/src/services/aiRouter.ts

@@ -68,8 +68,8 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 
 function mergeExtraBody(payload: JsonObject, extraBody: unknown): void {
   if (!isPlainObject(extraBody)) return;
-  // Never allow overriding required core fields.
-  const blocked = new Set(["model", "messages", "stream"]);
+  // Never allow overriding required core fields or prototype properties.
+  const blocked = new Set(["model", "messages", "stream", "__proto__", "constructor", "prototype"]);
   for (const [key, value] of Object.entries(extraBody)) {
     if (blocked.has(key)) continue;
     payload[key] = value as any;