fix(core): block prototype-pollution via run metadata operation keys (#65)

* fix(core): block prototype-pollution via run metadata operation keys

* chore: remove test, add changeset

* respond to devin comments

* fix(core): block prototype pollution in unflattenAttributes via dangerous key segments

* fix(core): preserve safe constructor attributes

* format

* chore(core): combine prototype pollution changeset

Author: carderne

.changeset/block-metadata-proto-pollution.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Prevent prototype pollution when applying run metadata operations or reconstructing nested telemetry attributes, while preserving legitimate `constructor` and `prototype` fields.

packages/core/src/v3/runMetadata/operations.ts

@@ -1,5 +1,5 @@
 import { JSONHeroPath } from "@jsonhero/path";
-import type { RunMetadataChangeOperation } from "../schemas/common.js";
+import { isSafeMetadataKey, type RunMetadataChangeOperation } from "../schemas/common.js";
 import { dequal } from "dequal";
 
 export type ApplyOperationResult = {
@@ -16,6 +16,13 @@ export function applyMetadataOperations(
   let newMetadata: Record<string, unknown> = structuredClone(currentMetadata);
 
   for (const operation of Array.isArray(operations) ? operations : [operations]) {
+    // Prevent unsafe JSON paths and direct __proto__ assignments from changing Object.prototype.
+    // ("update" carries no key.)
+    if (operation.type !== "update" && !isSafeMetadataKey(operation.key)) {
+      unappliedOperations.push(operation);
+      continue;
+    }
+
     switch (operation.type) {
       case "set": {
         if (operation.key.startsWith("$.")) {

packages/core/src/v3/schemas/common.ts

@@ -4,6 +4,25 @@ import type { RuntimeEnvironmentType as DBRuntimeEnvironmentType } from "@trigge
 
 export type Enum<T extends string> = { [K in T]: K };
 
+const DANGEROUS_METADATA_KEY_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
+
+/**
+ * Prototype-pollution guard for run metadata operation keys. JSON paths are applied via
+ * JSONHeroPath, so dangerous path segments must be rejected. Literal keys are assigned directly,
+ * where only __proto__ can change the target object's prototype.
+ */
+export function isSafeMetadataKey(key: string): boolean {
+  if (!key.startsWith("$.")) {
+    return key !== "__proto__";
+  }
+
+  return !key.split(/[.[\]'"]+/).some((segment) => DANGEROUS_METADATA_KEY_SEGMENTS.has(segment));
+}
+
+const MetadataOperationKey = z.string().refine(isSafeMetadataKey, {
+  message: "Metadata key may not reference __proto__, constructor, or prototype",
+});
+
 export const RunMetadataUpdateOperation = z.object({
   type: z.literal("update"),
   value: z.record(z.unknown()),
@@ -13,38 +32,38 @@ export type RunMetadataUpdateOperation = z.infer<typeof RunMetadataUpdateOperati
 
 export const RunMetadataSetKeyOperation = z.object({
   type: z.literal("set"),
-  key: z.string(),
+  key: MetadataOperationKey,
   value: DeserializedJsonSchema,
 });
 
 export type RunMetadataSetKeyOperation = z.infer<typeof RunMetadataSetKeyOperation>;
 
 export const RunMetadataDeleteKeyOperation = z.object({
   type: z.literal("delete"),
-  key: z.string(),
+  key: MetadataOperationKey,
 });
 
 export type RunMetadataDeleteKeyOperation = z.infer<typeof RunMetadataDeleteKeyOperation>;
 
 export const RunMetadataAppendKeyOperation = z.object({
   type: z.literal("append"),
-  key: z.string(),
+  key: MetadataOperationKey,
   value: DeserializedJsonSchema,
 });
 
 export type RunMetadataAppendKeyOperation = z.infer<typeof RunMetadataAppendKeyOperation>;
 
 export const RunMetadataRemoveFromKeyOperation = z.object({
   type: z.literal("remove"),
-  key: z.string(),
+  key: MetadataOperationKey,
   value: DeserializedJsonSchema,
 });
 
 export type RunMetadataRemoveFromKeyOperation = z.infer<typeof RunMetadataRemoveFromKeyOperation>;
 
 export const RunMetadataIncrementKeyOperation = z.object({
   type: z.literal("increment"),
-  key: z.string(),
+  key: MetadataOperationKey,
   value: z.number(),
 });
 

packages/core/src/v3/utils/flattenAttributes.ts

@@ -5,6 +5,10 @@ export const CIRCULAR_REFERENCE_SENTINEL = "$@circular((";
 
 const DEFAULT_MAX_DEPTH = 128;
 
+// This property name would let a crafted key walk into Object.prototype during
+// reconstruction and pollute the shared process.
+const PROTOTYPE_POLLUTION_KEY = "__proto__";
+
 export function flattenAttributes(
   obj: unknown,
   prefix?: string,
@@ -297,6 +301,11 @@ export function unflattenAttributes(
       continue;
     }
 
+    // Skip any key whose path could walk into Object.prototype.
+    if (parts.includes(PROTOTYPE_POLLUTION_KEY)) {
+      continue;
+    }
+
     let current: any = result;
     for (let i = 0; i < parts.length - 1; i++) {
       const part = parts[i];
@@ -330,8 +339,10 @@ export function unflattenAttributes(
     }
   }
 
-  // Convert the result to an array if all top-level keys are numeric indices
-  if (Object.keys(result).every((k) => /^\d+$/.test(k))) {
+  // Convert the result to an array if all top-level keys are numeric indices.
+  // Guard against an empty result (e.g. every key was skipped as unsafe), which
+  // would otherwise produce Array(-Infinity) and throw.
+  if (Object.keys(result).length > 0 && Object.keys(result).every((k) => /^\d+$/.test(k))) {
     const maxIndex = Math.max(...Object.keys(result).map((k) => parseInt(k)));
     const arrayResult = Array(maxIndex + 1);
     for (const key in result) {