🐛 [VULN-81506] fix prototype pollution via mergeInto and tryJsonParse

[bcaudan]

Motivation

mergeInto performed a recursive deep merge without guarding against __proto__, making it possible for external input to corrupt Object.prototype.

Changes

• Make mergeInto safe against prototype pollution by skipping __proto__ during recursive merge
• Ensure tryJsonParse never returns objects carrying __proto__ as an own property
• Harden storeContextManager and remoteConfigurationCache against malformed or untrusted localStorage data

Behavioral changes

mergeInto (and combine, deepClone) now silently drops the __proto__ key. tryJsonParse strips it from parsed JSON.

Test instructions

yarn test:unit

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[datadog-official]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 33.33%
• Overall Coverage: 76.85% (-0.03%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6291b50 | Docs | Datadog PR Page | Give us feedback!}

[cit-pr-commenter-54b7da]

Bundles Sizes Evolution

📦 Bundle Name	Base Size	Local Size	𝚫	𝚫%	Status
Rum	172.46 KiB	172.53 KiB	+62 B	+0.04%	✅
Rum Profiler	8.22 KiB	8.22 KiB	0 B	0.00%	✅
Rum Recorder	21.09 KiB	21.09 KiB	0 B	0.00%	✅
Logs	54.47 KiB	54.57 KiB	+100 B	+0.18%	✅
Rum Slim	129.97 KiB	130.02 KiB	+49 B	+0.04%	✅
Worker	22.96 KiB	22.96 KiB	0 B	0.00%	✅

[bcaudan]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 755693fc1b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bcaudan]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 6291b50753

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".