fix(dashboard): harden config selector paths

[LIghtJUNction]

Summary

• reject __proto__, prototype, and constructor segments in dashboard config selectors
• read only own properties while traversing selector paths
• port the focused hardening from dev commit 99f57c9

Why

The selector setter accepted arbitrary path segments and could write through JavaScript prototype-related keys. The getter also traversed inherited properties. This keeps selector access limited to the intended configuration object.

Impact

This is a one-file defensive change with no API, dependency, or configuration changes. Normal selector paths keep the existing behavior.

Extracted as a small, reviewable part of the broader draft PR #6325.

Validation

• pnpm run typecheck
• pnpm run build
• git diff --check

The production build completed successfully. Its existing Google Fonts download step logged a DNS warning in the restricted build environment but did not fail the build.

Summary by Sourcery

Harden dashboard configuration selector handling to avoid unsafe prototype path access while preserving existing behavior for normal selectors.

Bug Fixes:

• Prevent selector getters from traversing non-own properties on configuration objects.
• Block use of JavaScript prototype-related segments (such as proto, prototype, constructor) in selector paths for reads and writes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	astrbot-docs	fbbb681	Commit Preview URL Branch Preview URL	Aug 13 2026, 06:24 AM

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider extracting the repeated ['__proto__', 'prototype', 'constructor'] list into a shared constant or helper function to avoid duplication and make future changes to disallowed keys easier.
• You might want to guard Object.prototype.hasOwnProperty.call(current, key) with a more explicit object check (e.g., current !== null && typeof current === 'object') to avoid surprising behavior if current is ever a non-object value during traversal.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider extracting the repeated `['__proto__', 'prototype', 'constructor']` list into a shared constant or helper function to avoid duplication and make future changes to disallowed keys easier.
- You might want to guard `Object.prototype.hasOwnProperty.call(current, key)` with a more explicit object check (e.g., `current !== null && typeof current === 'object'`) to avoid surprising behavior if `current` is ever a non-object value during traversal.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}