False positive for Prototype-polluting function

I check for prototype polluting property keys in a set of reserved keys which include `__proto__` and `constructor`.

This shouldn't even be necessary since the key, value come from Object.entries which according to MDN will only iterate own enumerable string-keyd property. ie. never `__proto__` or `constructor`.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/entries


Still the lookup in the set does not work.

```js
// Iterate through the source own enumerable string-keyed property key-value pairs.
for (const [key, value] of Object.entries(source)) {

// This for codeql only. key, value of Object.entries should ensure that only own properties are parsed
if (!source.hasOwnProperty(key)) continue;

// The ignoreKeys contain checks against prototype pollution.
if (new Set(['__proto__', 'constructor', 'mapview']).has(key)) {

continue;
}
```

CodeQL looks at the right place but ignores the check for the set.

https://github.com/GEOLYTIX/xyz/security/code-scanning/217


The only way I can make the issue go away is by doing a === check on the string value like so.

```js
// Prevent prototype polluting assignment.
if (key === '__proto__' || key === 'constructor') return true;
```

Even though I know that this issue can not happen I need to add this extra line to make the CodeQL warning go away.

Start with the linked CodeQL code-scanning alert and the reported JavaScript snippet; no repository file or test is named. Trace how the relevant query handles Object.entries and Set membership, then add or update regression coverage so this false positive is no longer reported.

Rédigé par le modèle d'indexation à partir du texte de l'issue.