fix(security): prototype pollution, HTML text and ReDoS backlog (CodeQL) - #187

Closes the production-code CodeQL alerts open on main since the first scan (#160): prototype pollution (42–44), the HTML-text sanitizer (41) and the polynomial/exponential ReDoS backlog (11, 12, 13, 16, 17, 19, 20, 23, 24, 30, 32, 35, 36), plus alert 45, whose real sink was in surfaces/body.ts. The Actions and test/script alerts follow in a second PR.

Prototype pollution (alerts 42, 43, 44)

pointerSet in @cloudhal/core-ts/interop (A2UI updateDataModel, reachable from agent and MCP input) skipped reserved keys silently and wrote through cur[s]. It now lives in surface-interop-data.ts and:

• refuses __proto__, constructor and prototype at every level with an InteropError (not a silent skip); the check is inline at each step, in front of every write;
• reads with Object.hasOwn and writes with Object.defineProperty (own data properties only, never a setter or the prototype chain); deletes only own keys;
• steps into arrays by index only (/list/length is an error).

Other setters found by grepping:

• Surface binding pointers accepted /__proto__/x, and the Build eval's withSampleInputs (packages/api/src/build-eval.ts) writes through binding paths with at[k] = {} — a real pollution path from model output. checkSurface now reports reserved keys in pointers the page writes through (an input's value/checked, a Scrolly's step, a Button action's path; checkWrittenPointer); read bindings may still name constructor or prototype (they go through the own-only getPointer), so existing pages keep saving. withSampleInputs skips reserved keys and reads own properties only.
• A2UI fallback data key: an input with a literal value gets its component id as data key; an id prototype/constructor now gets <id>-value instead of failing the conversion (dataKeyFor).
• MCP merge patches: set_chrome's part merge and update_entry's fields merge assigned out[k] = v for keys from JSON input. A JSON "__proto__" key there swaps the object's prototype (not global, but wrong). Both now refuse reserved keys with ToolError("invalid").
• JSON Patch (applyPatch / patchPage) already refused reserved keys with an error and used hasOwn; it now shares RESERVED_KEYS from @cloudhal/core-ts/names (new, with isReservedKey).
• Checked and left: shallow one-level copies keyed by validated names (taxonomy keys, field keys matching the key pattern, directive attrs), and the browser surface runtime (surface-client.ts), which already skips reserved keys and only ever writes the page's own data.

Tests (core-ts/test/interop-pollution.test.ts, mcp-server chrome and fields tests, api/test/design-pass.test.ts): /__proto__/x, /__proto__, /constructor/prototype/x, nested and ~1-encoded forms, deletes; each asserts the error and that ({}).x stays undefined.

htmlText (alert 41)

htmlText stripped tags with /<[^>]*>/ (also a rule-13 pattern) and decoded entities afterwards, so <script> became <script>. Callers and sinks, traced:

Decision (after review): htmlText returns plain text, verbatim (Array<string> reads Array<string>; the first revision's U+FF1C rewrite changed visible text and is gone). Safety is each sink's, and test/html-text-sinks.test.ts proves it sink by sink: <script>alert(1)</script> <!-- c --> <img onerror> "><svg onload> goes through each, and the output is parsed with parse5, which must find no element or comment beyond the sink's own:

llms.txt does not call htmlText: it is Markdown served as text/plain. No sink needed a fix. The tag strip is still the linear scanner, and entities are decoded once (< is the text <; the old chain decoded it twice). If CodeQL still reports htmlText after merge, that one alert is dismissed with this table as the reason.

ReDoS (rule 13)

Each rewrite is a linear scanner with an equivalence test against the old regex (hand-picked cases plus 20k seeded random strings over the characters that matter, or every short string over a small alphabet) and 100k-character adversarial inputs under 1.5 s.

Checks

• Review round: astro-renderer 51 files / 369 tests, core-ts 63 / 1127 (alone; chained after another suite the Miniflare D1/DO halves dropped connections again), size:check, design:lint, lint.
• First round, pnpm exec vitest run per package, one at a time, all green: core-ts 63 files / 1122 tests, astro-renderer 50 / 363, mcp-server 24 / 176, ui 18 / 216, api 45 / 617, cloudflare 14 / 57, cli 63 / 446. (A first core-ts run alongside other suites dropped Miniflare D1 connections in the D1 halves of the store suites; the re-run on its own passed.)
• pnpm lint (warnings only, as on main), pnpm size:check (surface-interop.ts shrank 1233 → 1192; baseline tightened), pnpm design:lint, tsc --noEmit in all seven packages.

Patch changeset for core-ts, astro-renderer, api, mcp-server, cloudflare and cli (@cloudhal/ui is private).

Follow-up (not in this PR)

core-ts/src/structured-data/values.ts bodyText (HTML bodies → JSON-LD articleBody) has the same strip-then-decode shape and a lazy <script>…</script> scan; CodeQL did not flag it and its sink (jsonLdText) escapes, but it should use the same scanners.

🤖 Generated with Claude Code