CodeQL fixes 2

Author: Rajat

apps/web/app/api/scorm/lesson/[lessonId]/runtime/route.ts

@@ -197,7 +197,8 @@ function setNestedValue(obj: any, path: string, value: unknown): void {
         }
         if (current[part] === undefined) {
             const nextPart = parts[i + 1];
-            current[part] = /^\d+$/.test(nextPart) ? [] : {};
+            // Use Object.create(null) to create objects without prototype chain
+            current[part] = /^\d+$/.test(nextPart) ? [] : Object.create(null);
         }
         current = current[part];
     }

apps/web/components/public/lesson-viewer/scorm-viewer.tsx

@@ -328,7 +328,8 @@ function setNestedValue(obj: any, path: string, value: unknown): void {
         }
 
         if (current[part] === undefined || current[part] === null) {
-            current[part] = {};
+            // Use Object.create(null) to create objects without prototype chain
+            current[part] = Object.create(null);
         }
 
         current = current[part];

apps/web/lib/scorm/cache.ts

@@ -113,6 +113,30 @@ async function fetchZipFromMediaLit(
     }
 }
 
+/**
+ * Validate ZIP entry name to prevent directory traversal
+ */
+function isSafeZipEntryName(entryName: string): boolean {
+    if (!entryName) return false;
+
+    // ZIP specification uses '/' as directory separator; reject backslashes
+    if (entryName.includes("\\")) return false;
+
+    // Reject absolute paths or Windows drive-letter paths (e.g. "C:...").
+    if (entryName.startsWith("/")) return false;
+    if (/^[a-zA-Z]:/.test(entryName)) return false;
+
+    // Normalize and ensure there are no ".." segments.
+    const segments = entryName.split("/");
+    for (const segment of segments) {
+        if (segment === "..") {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 /**
  * Extract ZIP to disk directory
  */
@@ -130,6 +154,14 @@ async function extractZipToDisk(
     const resolvedExtractDir = path.resolve(extractDir);
     for (const entry of zip.getEntries()) {
         if (!entry.isDirectory) {
+            // Validate entry name to prevent directory traversal (Zip Slip)
+            if (!isSafeZipEntryName(entry.entryName)) {
+                error("Skipping unsafe ZIP entry name during extraction", {
+                    entryName: entry.entryName,
+                });
+                continue;
+            }
+
             const targetPath = path.join(resolvedExtractDir, entry.entryName);
             const resolvedTargetPath = path.resolve(targetPath);