[fix][core] test for a plain container by prototype, not by reading constructor

[ar2rsawseen]

escape_html_entities decided whether to walk into a value by reading its constructor:

if (typeof value === 'object' && value && (value.constructor === Object || value.constructor === Array)) {

constructor is an ordinary property name, so a JSON body can carry its own. {"constructor": true, ...} makes value.constructor evaluate to true, the comparison fails, and the object is returned with its keys and values unescaped.

Why this is not a local problem

This function is the replacer passed to JSON.stringify by every returnOutput and returnMessage. It is the control that lets the rest of the product assume API output is escaped. So any response object whose property names originate in ingested data could carry markup through it untouched, and any consumer rendering those names would render the markup.

The public ingestion endpoint accepts arbitrary property names inside the consent object, so planting one needs no account.

The fix

Prototype identity, which an own property cannot spoof:

function isPlainContainer(value) {
    if (Array.isArray(value)) { return true; }
    const proto = Object.getPrototypeOf(value);
    return proto === Object.prototype || proto === null;
}

This keeps the original intent exactly. The alternative of Object.prototype.toString.call(value) === '[object Object]' would have been wrong: a MongoDB ObjectID reports [object Object] and would start being walked into rather than serialized as an id, changing responses across the API.

Verification

The real function was lifted and run through JSON.stringify before and after. Before, the attack input serializes with the markup key verbatim: {"constructor":true,"<img src=x onerror=alert(1)>":true}. After, it is escaped, both at the top level and nested one level down as a consent object would be.

Unchanged, checked explicitly: plain nested objects, arrays of strings, plain text, numbers, booleans, ObjectID still serializing as a scalar id, and Date still serializing as a date string.