commit

src/main/resources/views/layouts/v4/baseLayout.html

@@ -101,26 +101,28 @@
         <script src="https://map.qq.com/api/gljs?v=2.exp&key=MLLBZ-GQECI-ASXG7-5GNOZ-XW2OF-H5BVH"></script>
 
         <script>
-            // 安全地冻结 Object.prototype（跳过不可配置属性）
+            // 在加载 lodash 后、使用前插入
-            (function () {
+            const originalDefaultsDeep = window._.defaultsDeep;
-                const badKeys = ['constructor', 'prototype'];
+            window._.defaultsDeep = function(...args) {
-                for (const key of badKeys) {
+                // 先对所有参数做原型污染清洗
-                    if (key in Object.prototype) {
+                const cleanArgs = args.map(arg => sanitizeForPrototypePollution(arg));
-                        try {
+                return originalDefaultsDeep.apply(window._, cleanArgs);
-                            delete Object.prototype[key];
+            };
-                        } catch (e) {
-                            // 忽略无法删除的属性（如 __proto__ 在现代浏览器中不可删除）
-                        }
-                    }
-                }
 
-                // 冻结 Object.prototype（如果可能）
+            function sanitizeForPrototypePollution(obj) {
-                try {
+                if (obj === null || typeof obj !== 'object') return obj;
-                    Object.freeze(Object.prototype);
+                if (Array.isArray(obj)) return obj.map(sanitizeForPrototypePollution);
-                } catch (e) {
+
-                    // 忽略错误（某些环境可能不允许）
+                const clean = {};
+                for (const key in obj) {
+                    if (!Object.hasOwn(obj, key)) continue;
+                    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                        continue;
+                    }
+                    clean[key] = sanitizeForPrototypePollution(obj[key]);
                 }
-            })();
+                return clean;
+            }
         </script>
 
         <script type="text/javascript">

src/main/resources/views/platform/sys/login.html

@@ -100,26 +100,28 @@
     <!-- import jsencrypt-->
     <script src="${base!}/assets/platform/plugins/jsencrypt/jsencrypt.min.js"></script>
     <script>
-        // 安全地冻结 Object.prototype（跳过不可配置属性）
+        // 在加载 lodash 后、使用前插入
-        (function () {
+        const originalDefaultsDeep = window._.defaultsDeep;
-            const badKeys = ['constructor', 'prototype'];
+        window._.defaultsDeep = function(...args) {
-            for (const key of badKeys) {
+            // 先对所有参数做原型污染清洗
-                if (key in Object.prototype) {
+            const cleanArgs = args.map(arg => sanitizeForPrototypePollution(arg));
-                    try {
+            return originalDefaultsDeep.apply(window._, cleanArgs);
-                        delete Object.prototype[key];
+        };
-                    } catch (e) {
-                        // 忽略无法删除的属性（如 __proto__ 在现代浏览器中不可删除）
-                    }
-                }
-            }
 
-            // 冻结 Object.prototype（如果可能）
+        function sanitizeForPrototypePollution(obj) {
-            try {
+            if (obj === null || typeof obj !== 'object') return obj;
-                Object.freeze(Object.prototype);
+            if (Array.isArray(obj)) return obj.map(sanitizeForPrototypePollution);
-            } catch (e) {
+
-                // 忽略错误（某些环境可能不允许）
+            const clean = {};
+            for (const key in obj) {
+                if (!Object.hasOwn(obj, key)) continue;
+                if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+                    continue;
+                }
+                clean[key] = sanitizeForPrototypePollution(obj[key]);
             }
-        })();
+            return clean;
+        }
     </script>
     <script>
         new Vue({