[Low][store] deepClone does not guard __proto__ key → clone prototype reassignment #175

Severity: 🟢 Low (robustness)

Location

src/store/utils.ts:43-47 (deepClone), consumed by $patchDeep (src/store/create-store.ts:429-443).

Description

Unlike src/core/utils/object.ts (which guards prototype-pollution keys), the store's deepClone assigns via bracket notation over Object.keys:

cloned[key] = deepClone(source[key]);

A state object with an own enumerable __proto__ key (e.g. produced by JSON.parse('{"__proto__":{…}}')) triggers the __proto__ setter, reassigning the clone's prototype rather than copying a data property. This is contained (it does not pollute global Object.prototype) but corrupts the cloned object used by $patchDeep. A fidelity/robustness bug rather than a global pollution vector.

Suggested fix

Skip prototype-pollution keys (reuse isPrototypePollutionKey from object.ts), or assign with Object.defineProperty(cloned, key, { value, enumerable: true, writable: true, configurable: true }).

Filed as part of a full-codebase security & correctness audit.