fix(unset): guard against prototype keyword path traversal

[JSap0914]

Summary

unset() in src/utils/unset.ts traverses path segments through baseGet() without checking for prototype-pollution keywords (__proto__, constructor, prototype). This allows callers to inadvertently (or maliciously) delete properties from Object.prototype.

set.ts already contains an equivalent guard:

if (PROTOTYPE_KEYWORDS.includes(key)) {
  return;
}

but unset.ts was never updated to match.

Bug

import unset from "./src/utils/unset";

// Prototype extended by some library / JSON merge vulnerability
Object.prototype.polluted = "SENSITIVE";

unset({}, "__proto__.polluted");

console.log({}.polluted); // undefined — deleted from Object.prototype!

The same issue occurs with array-form paths (["__proto__", "polluted"]) and the constructor / prototype keywords.

Fix

After computing the paths array in unset(), bail out immediately (no-op) if any segment is in PROTOTYPE_KEYWORDS, mirroring the guard in set.ts.

Verification

New test added to src/__tests__/utils/unset.test.ts:

• RED (before fix): test fails — unset({}, "__proto__.foo") deleted from Object.prototype.
• GREEN (after fix): 19/19 tests pass, including the new prototype-guard test.

Tests: 19 passed, 19 total

Full utils suite still green: 134/134 tests pass.

Closes #13559

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.