fix: prevent prototype pollution in extend() and objExtend() via __proto__ key filtering

[hectorhdzg]

Both extend() in extUtils.ts and objExtend() in HelperFuncs.ts were vulnerable to prototype pollution when processing untrusted input containing proto keys (e.g. from JSON.parse). In deep extend mode, target['proto'] resolves to Object.prototype via the getter, causing recursive merge to directly mutate Object.prototype and pollute all objects globally.

• Add proto key guard in extend() objForEachKey callback

• Add proto key guard in objExtend() for...in loop

• Add prototype pollution unit tests for both functions

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Prevents prototype pollution vulnerabilities in extend() and objExtend() when merging untrusted input containing __proto__, and adds unit tests to verify the fix.

Changes:

• Skip merging __proto__ keys in objExtend() and extend()
• Add unit tests covering shallow/deep merges and nested cases
• Validate safe properties still merge when malicious keys are present

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
shared/AppInsightsCore/src/utils/HelperFuncs.ts	Adds __proto__ key filtering to objExtend() loop to block prototype pollution
shared/AppInsightsCore/src/ext/extUtils.ts	Adds __proto__ key filtering inside extend() iteration to prevent deep-merge pollution
shared/AppInsightsCore/Tests/Unit/src/ext/UtilsTest.ts	Adds extend() regression tests for shallow/deep merges with __proto__ input
shared/AppInsightsCore/Tests/Unit/src/ai/HelperFunc.Tests.ts	Adds objExtend() regression tests including nested __proto__ scenarios