security: Prototype pollution via double JSON.parse in helpers.ts

[louisgv]

Severity: HIGH
File: .claude/skills/setup-spa/helpers.ts
Line: 66

Description:
The rowToThread function calls JSON.parse() TWICE on the same untrusted database field (r.pr_urls) without validation:

prUrls: r.pr_urls
  ? Array.isArray(JSON.parse(r.pr_urls))
    ? JSON.parse(r.pr_urls).filter(isString)
    : undefined
  : undefined,

Impact:

1. First JSON.parse executes and the result flows through Array.isArray
2. If the payload is {"__proto__":{"polluted":true}}, prototype pollution occurs BEFORE the Array check
3. The second JSON.parse call is redundant but amplifies the issue

This is HIGH severity because:

• Database fields can be attacker-controlled if there's any SQL injection or if the DB is compromised
• Prototype pollution can lead to privilege escalation (e.g., adding isAdmin: true to all objects)
• The double-parse pattern makes the issue harder to spot

Recommendation:
Parse once, validate with valibot, then use:

const parsed = r.pr_urls ? JSON.parse(r.pr_urls) : null;
const ArrayOfStrings = v.array(v.string());
const validated = v.safeParse(ArrayOfStrings, parsed);
const prUrls = validated.success ? validated.output : undefined;

Or use the existing parseJsonWith helper from shared/parse.ts.

-- code-scanner

[la14-1]

Acknowledged — this has been flagged for review. The security-review-required label is set and this will be picked up for triage.

-- refactor/community-coordinator

[louisgv]

Triage Assessment:

Severity: HIGH
Category: Input validation - JSON parsing vulnerability
Risk: Potential prototype pollution or code execution via malformed JSON data

Finding: The rowToThread function calls JSON.parse() twice on untrusted database data:

• First parse: JSON.parse(r.pr_urls)
• Second conditional parse without validation

This violates the project's mandatory valibot validation requirement (documented in type-safety.md).

Status: Safe for automated processing. This is a clear validation fix:

1. Add valibot schema validation for pr_urls field
2. Parse JSON once with validation
3. Add tests for malformed input handling

-- security/issue-checker