🔒 Fix Prototype Pollution in setNested - #2

Merged
akutuva21 merged 3 commits into
masterfrom
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged

🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom
security-fix-prototype-pollution-15072088604429859966

Conversation

@akutuva21

@akutuva21akutuva21 commented Apr 13, 2026

Copy link
Copy Markdown
Owner

🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.

⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.

🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.

PR created automatically by Jules for task 15072088604429859966 started by @akutuva21

@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules

google-labs-julesBot commented Apr 13, 2026

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

akutuva21
akutuva21 commented Apr 13, 2026
View reviewed changes

@akutuva21akutuva21 left a comment

Copy link
Copy Markdown
OwnerAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.

@akutuva21
akutuva21 merged commit 13a88be into masterApr 13, 2026
@akutuva21
akutuva21 deleted the security-fix-prototype-pollution-15072088604429859966 branch April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
🔒 Fix Prototype Pollution in setNested - #2
Merged
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Apr 13, 2026
Merged
🔒 Fix Prototype Pollution in setNested#2
akutuva21 merged 3 commits into
masterfrom 
security-fix-prototype-pollution-15072088604429859966
Conversation
@akutuva21
@akutuva21akutuva21
commented
Apr 13, 2026

Copy link


Copy Markdown

Owner
🎯 What: The setNested function in scripts/generate-manifest.js was vulnerable to Prototype Pollution. It allowed malicious payloads to construct or modify paths containing __proto__, constructor, or prototype, traversing up to the global prototype object.
⚠️Risk: If an attacker provided a crafted input, they could manipulate the global Object.prototype. This can lead to arbitrary code execution, denial of service (DoS), or logic manipulation of the JavaScript runtime.
🛡️ Solution: Added an explicit check within the traversal loop to skip (continue) any key matching __proto__, constructor, or prototype. Additionally, applied the same check to the final assignment step (return early) so that the global prototype/constructor itself cannot be re-assigned. This completely mitigates the vulnerability in setNested.
PR created automatically by Jules for task 15072088604429859966 started by @akutuva21
@google-labs-jules@akutuva21
🔒 Fix Prototype Pollution in setNested
9841cff
Fixes a prototype pollution vulnerability in the `setNested` utility function within `scripts/generate-manifest.js`. The fix explicitly skips and filters out dangerous property names (`__proto__`, `constructor`, `prototype`) during both object traversal and final assignment.
Co-authored-by: akutuva21 <44119804+akutuva21@users.noreply.github.com>
@google-labs-jules
google-labs-julesBot
commented
Apr 13, 2026

Copy link


Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.
When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.
I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!
For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!
New to Jules? Learn more at jules.google/docs.
For security, I will only act on instructions from the user who triggered this task.
akutuva21
akutuva21
commented
Apr 13, 2026
View reviewed changes
@akutuva21akutuva21
left a comment


Copy link


Copy Markdown

OwnerAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed in sequence. Branch now hardens nested-key assignment consistently in both metadata parsers, closing the prototype-pollution gap.
@akutuva21
akutuva21
merged commit 13a88be
into
masterApr 13, 2026
@akutuva21
akutuva21
deleted the

security-fix-prototype-pollution-15072088604429859966

branch
April 13, 2026 15:27
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@akutuva21