github / github/codeql

False positive: js/prototype-pollution-utility

Open
#13,339 4 comments 0 reactions 0 assignees View on GitHub
false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Hello, I'm getting a CodeQL alert for a Prototype-polluting function.
There is a guard in place (highlighted in image below):

image

Source code is here: https://github.com/mui/material-ui/blob/v4.x/packages/material-ui-utils/src/deepmerge.js#L10

Contributor guide

Open the contributing guide

Research direction

Start with packages/material-ui-utils/src/deepmerge.js at line 10 and inspect the guard shown in the issue, then trace how the js/prototype-pollution-utility alert analyzes this pattern. Confirm whether the alert is a false positive and define the corresponding query behavior or regression coverage as the completion criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.