ruel225 b6330edbe4 fix(sdk): add prototype-pollution guard to migration config merge (#103059) (#106116) ...

* fix(sdk): add prototype-pollution guard to migration config merge

mergeMigrationConfigValue and writeMigrationConfigPath had no
isBlockedObjectKey guard, allowing __proto__/constructor/prototype
keys from imported config files to trigger prototype pollution.

Add the same guard used by the sibling config-path writer
(setConfigValueAtPath/parseConfigPath) to reject blocked object
keys before they reach a bracket assignment.

Fixes #103059

* fix(sdk): harden migration config patches

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-07-13 15:14:58 -07:00

..

test

docs: document small extension sources

2026-06-04 21:02:07 -04:00

apply-identity.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

apply.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

auth-config.ts

docs: document small extension sources

2026-06-04 21:02:07 -04:00

auth-source.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

auth.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

config-env.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

config-mcp.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

config-provider-contract.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

config-providers.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

config.test.ts

fix(sdk): add prototype-pollution guard to migration config merge (#103059) (#106116)

2026-07-13 15:14:58 -07:00

config.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

files-and-skills.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

helpers.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

index.ts

docs: document small extension sources

2026-06-04 21:02:07 -04:00

items.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

model.apply.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

model.plan.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

model.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

openclaw.plugin.json

…

package.json

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

plan.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

provider.secret-failure.test.ts

docs: document small extension sources

2026-06-04 21:02:07 -04:00

provider.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

provider.ts

docs: document small extension sources

2026-06-04 21:02:07 -04:00

secret-mappings.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

secrets.test.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

secrets.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

skills.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

source.ts

fix(migrate): import current Hermes state and provider contracts (#106758)

2026-07-13 12:53:13 -07:00

targets.ts

refactor: consolidate core stream cleanup, watchdog locality, and approval text duplication (#99901)

2026-07-04 02:08:35 -07:00