Protect against prototype pollution in markup parser

Author: RinZ27

src/framework/components/element/markup.js

@@ -334,7 +334,7 @@ class Parser {
 // of assign)
 function merge(target, source) {
     for (const key in source) {
-        if (!source.hasOwnProperty(key)) {
+        if (!source.hasOwnProperty(key) || key === '__proto__' || key === 'constructor' || key === 'prototype') {
             continue;
         }
         const value = source[key];

test/framework/components/element/markup-security.test.mjs

@@ -0,0 +1,26 @@
+import { expect } from 'chai';
+import { Markup } from '../../../../src/framework/components/element/markup.js';
+
+describe('Markup Prototype Pollution', function () {
+    it('should ignore sensitive keys like __proto__ during merging', function () {
+        const symbols = ['[', '_', '_', 'p', 'r', 'o', 't', 'o', '_', '_', ' ', 'p', 'o', 'l', 'l', 'u', 't', 'e', 'd', '=', '"', 't', 'r', 'u', 'e', '"', ']', 'h', 'e', 'l', 'l', 'o'];
+        
+        // Ensure Object.prototype is clean before test
+        expect({}.polluted).to.be.undefined;
+
+        try {
+            Markup.evaluate(symbols);
+        } catch (e) {
+            // ignore potential errors during evaluation as we only care about pollution
+        }
+
+        expect({}.polluted).to.be.undefined;
+    });
+
+    it('should ignore constructor and prototype keys', function () {
+        const symbols = ['[', 'c', 'o', 'n', 's', 't', 'r', 'u', 'c', 't', 'o', 'r', ']', 't', 'e', 's', 't'];
+        
+        const results = Markup.evaluate(symbols);
+        expect(results.tags).to.not.have.property('constructor');
+    });
+});