[pitboss/grind] deferred session-0013 (20260520T233019Z-6958)

src/dynamic/framework/adapters/mod.rs

@@ -463,3 +463,26 @@ pub(super) fn strip_sigils(s: &str) -> &str {
         .trim_start_matches('@')
         .trim_start_matches('&')
 }
+
+/// True when the source file visibly mitigates prototype-pollution
+/// through a known guard pattern: a quoted `'__proto__'` / `"__proto__"`
+/// comparison (canonical per-key filter), or a global
+/// `Object.freeze(Object.prototype)` / `Object.seal(Object.prototype)`
+/// mitigation. Used by the Phase 10 `pp-lodash-merge` /
+/// `pp-object-assign` / `pp-json-deep-assign` adapters to skip binding
+/// when the surrounding code already neutralises the gadget.
+///
+/// The quoted-string form deliberately excludes backtick-wrapped
+/// `__proto__` in doc comments so fixtures that mention the key in
+/// prose still bind correctly.
+pub(super) fn source_filters_proto_keys(file_bytes: &[u8]) -> bool {
+    const NEEDLES: &[&[u8]] = &[
+        b"'__proto__'",
+        b"\"__proto__\"",
+        b"Object.freeze(Object.prototype",
+        b"Object.seal(Object.prototype",
+    ];
+    NEEDLES
+        .iter()
+        .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
+}

src/dynamic/framework/adapters/pp_json_deep_assign.rs

@@ -75,6 +75,9 @@ impl FrameworkAdapter for PpJsonDeepAssignJsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_json_parse);
         let matches_source = source_has_deep_merge_helper(file_bytes);
         if matches_call && matches_source {
@@ -104,6 +107,9 @@ impl FrameworkAdapter for PpJsonDeepAssignTsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_json_parse);
         let matches_source = source_has_deep_merge_helper(file_bytes);
         if matches_call && matches_source {
@@ -153,4 +159,25 @@ mod tests {
             .detect(&summary, tree.root_node(), src)
             .is_none());
     }
+
+    #[test]
+    fn skips_when_proto_key_filter_present() {
+        let src: &[u8] = b"function deepMerge(t, s) {\n\
+              for (const k of Object.keys(s)) {\n\
+                if (k === '__proto__' || k === 'constructor') continue;\n\
+                t[k] = s[k];\n\
+              }\n\
+              return t;\n\
+            }\n\
+            function run(payload) { return deepMerge({}, JSON.parse(payload)); }\n";
+        let tree = parse_js(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("JSON.parse")],
+            ..Default::default()
+        };
+        assert!(PpJsonDeepAssignJsAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
 }

src/dynamic/framework/adapters/pp_lodash_merge.rs

@@ -65,6 +65,9 @@ impl FrameworkAdapter for PpLodashMergeJsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_lodash_merge);
         let matches_source = source_imports_lodash(file_bytes);
         if matches_call && matches_source {
@@ -94,6 +97,9 @@ impl FrameworkAdapter for PpLodashMergeTsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_lodash_merge);
         let matches_source = source_imports_lodash(file_bytes);
         if matches_call && matches_source {
@@ -142,4 +148,40 @@ mod tests {
             .detect(&summary, tree.root_node(), src)
             .is_none());
     }
+
+    #[test]
+    fn skips_when_proto_key_filter_present() {
+        let src: &[u8] = b"const _ = require('lodash');\n\
+            function run(payload) {\n\
+              for (const k of Object.keys(payload)) {\n\
+                if (k === '__proto__' || k === 'constructor') continue;\n\
+              }\n\
+              return _.merge({}, payload);\n\
+            }\n";
+        let tree = parse_js(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("merge")],
+            ..Default::default()
+        };
+        assert!(PpLodashMergeJsAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
+
+    #[test]
+    fn skips_when_object_prototype_frozen() {
+        let src: &[u8] = b"const _ = require('lodash');\n\
+            Object.freeze(Object.prototype);\n\
+            function run(payload) { return _.merge({}, payload); }\n";
+        let tree = parse_js(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("merge")],
+            ..Default::default()
+        };
+        assert!(PpLodashMergeJsAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
 }

src/dynamic/framework/adapters/pp_object_assign.rs

@@ -12,16 +12,11 @@ use crate::summary::FuncSummary;
 use crate::symbol::Lang;
 
 fn callee_is_object_assign(name: &str) -> bool {
-    let last = name.rsplit_once('.').map(|(_, s)| s).unwrap_or(name);
-    matches!(last, "assign" | "create")
-        && (name == "Object.assign" || name == "Object.create" || name == "assign" || name == "create")
+    matches!(name, "Object.assign" | "assign")
 }
 
 fn source_uses_object_assign(file_bytes: &[u8]) -> bool {
-    const NEEDLES: &[&[u8]] = &[
-        b"Object.assign",
-        b"Object.create",
-    ];
+    const NEEDLES: &[&[u8]] = &[b"Object.assign"];
     NEEDLES
         .iter()
         .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
@@ -57,6 +52,9 @@ impl FrameworkAdapter for PpObjectAssignJsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_object_assign);
         let matches_source = source_uses_object_assign(file_bytes);
         if matches_call && matches_source {
@@ -86,6 +84,9 @@ impl FrameworkAdapter for PpObjectAssignTsAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if super::source_filters_proto_keys(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_object_assign);
         let matches_source = source_uses_object_assign(file_bytes);
         if matches_call && matches_source {
@@ -133,4 +134,38 @@ mod tests {
             .detect(&summary, tree.root_node(), src)
             .is_none());
     }
+
+    #[test]
+    fn skips_object_create_null_mitigation() {
+        let src: &[u8] =
+            b"function run(payload) { return Object.create(null); }\n";
+        let tree = parse_js(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("Object.create")],
+            ..Default::default()
+        };
+        assert!(PpObjectAssignJsAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
+
+    #[test]
+    fn skips_when_proto_key_filter_present() {
+        let src: &[u8] = b"function run(payload) {\n\
+              for (const k of Object.keys(payload)) {\n\
+                if (k === '__proto__' || k === 'constructor') continue;\n\
+              }\n\
+              return Object.assign({}, payload);\n\
+            }\n";
+        let tree = parse_js(src);
+        let summary = FuncSummary {
+            name: "run".into(),
+            callees: vec![crate::summary::CalleeSite::bare("Object.assign")],
+            ..Default::default()
+        };
+        assert!(PpObjectAssignJsAdapter
+            .detect(&summary, tree.root_node(), src)
+            .is_none());
+    }
 }