False positive: js/prototype-pollution-utility
Open
false-positive
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
Hello, I'm getting a CodeQL alert for a Prototype-polluting function.
There is a guard in place (highlighted in image below):
Source code is here: https://github.com/mui/material-ui/blob/v4.x/packages/material-ui-utils/src/deepmerge.js#L10
Contributor guide
Research direction
Start with packages/material-ui-utils/src/deepmerge.js at line 10 and inspect the guard shown in the issue, then trace how the js/prototype-pollution-utility alert analyzes this pattern. Confirm whether the alert is a false positive and define the corresponding query behavior or regression coverage as the completion criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100