From f92023a9200108a141c105a83c02858e76d6ed13 Mon Sep 17 00:00:00 2001
From: "@jyuhsin" <729757837@qq.com>
Date: Thu, 18 Dec 2025 16:57:15 +0800
Subject: [PATCH] commit

---
 .../views/layouts/v4/baseLayout.html          | 38 ++++++++++---------
 .../resources/views/platform/sys/login.html   | 38 ++++++++++---------
 2 files changed, 40 insertions(+), 36 deletions(-)

diff --git a/src/main/resources/views/layouts/v4/baseLayout.html b/src/main/resources/views/layouts/v4/baseLayout.html
index 3c69200..454e233 100644
--- a/src/main/resources/views/layouts/v4/baseLayout.html
+++ b/src/main/resources/views/layouts/v4/baseLayout.html
@@ -101,26 +101,28 @@
         <script src="https://map.qq.com/api/gljs?v=2.exp&key=MLLBZ-GQECI-ASXG7-5GNOZ-XW2OF-H5BVH"></script>
 
         <script>
-            // 安全地冻结 Object.prototype（跳过不可配置属性）
-            (function () {
-                const badKeys = ['constructor', 'prototype'];
-                for (const key of badKeys) {
-                    if (key in Object.prototype) {
-                        try {
-                            delete Object.prototype[key];
-                        } catch (e) {
-                            // 忽略无法删除的属性（如 __proto__ 在现代浏览器中不可删除）
-                        }
-                    }
-                }
+            // 在加载 lodash 后、使用前插入
+            const originalDefaultsDeep = window._.defaultsDeep;
+            window._.defaultsDeep = function(...args) {
+                // 先对所有参数做原型污染清洗
+                const cleanArgs = args.map(arg => sanitizeForPrototypePollution(arg));
+                return originalDefaultsDeep.apply(window._, cleanArgs);
+            };
 
-                // 冻结 Object.prototype（如果可能）
-                try {
-                    Object.freeze(Object.prototype);
-                } catch (e) {
-                    // 忽略错误（某些环境可能不允许）
+            function sanitizeForPrototypePollution(obj) {
+                if (obj === null || typeof obj !== 'object') return obj;
+                if (Array.isArray(obj)) return obj.map(sanitizeForPrototypePollution);
+
+                const clean = {};
+                for (const key in obj) {
+                    if (!Object.hasOwn(obj, key)) continue;
+                    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                        continue;
+                    }
+                    clean[key] = sanitizeForPrototypePollution(obj[key]);
                 }
-            })();
+                return clean;
+            }
         </script>
 
         <script type="text/javascript">
diff --git a/src/main/resources/views/platform/sys/login.html b/src/main/resources/views/platform/sys/login.html
index a912b8a..30762de 100644
--- a/src/main/resources/views/platform/sys/login.html
+++ b/src/main/resources/views/platform/sys/login.html
@@ -100,26 +100,28 @@
     <!-- import jsencrypt-->
     <script src="${base!}/assets/platform/plugins/jsencrypt/jsencrypt.min.js"></script>
     <script>
-        // 安全地冻结 Object.prototype（跳过不可配置属性）
-        (function () {
-            const badKeys = ['constructor', 'prototype'];
-            for (const key of badKeys) {
-                if (key in Object.prototype) {
-                    try {
-                        delete Object.prototype[key];
-                    } catch (e) {
-                        // 忽略无法删除的属性（如 __proto__ 在现代浏览器中不可删除）
-                    }
-                }
-            }
+        // 在加载 lodash 后、使用前插入
+        const originalDefaultsDeep = window._.defaultsDeep;
+        window._.defaultsDeep = function(...args) {
+            // 先对所有参数做原型污染清洗
+            const cleanArgs = args.map(arg => sanitizeForPrototypePollution(arg));
+            return originalDefaultsDeep.apply(window._, cleanArgs);
+        };
 
-            // 冻结 Object.prototype（如果可能）
-            try {
-                Object.freeze(Object.prototype);
-            } catch (e) {
-                // 忽略错误（某些环境可能不允许）
+        function sanitizeForPrototypePollution(obj) {
+            if (obj === null || typeof obj !== 'object') return obj;
+            if (Array.isArray(obj)) return obj.map(sanitizeForPrototypePollution);
+
+            const clean = {};
+            for (const key in obj) {
+                if (!Object.hasOwn(obj, key)) continue;
+                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                    continue;
+                }
+                clean[key] = sanitizeForPrototypePollution(obj[key]);
             }
-        })();
+            return clean;
+        }
     </script>
     <script>
         new Vue({