fix: prototype pollution vulnerability in extend (CVE-2024-45435) (#1433)

* chore: upgrade broken GitHub Actions

https://github.com/orgs/community/discussions/142581

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

* chore: update storyshots

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

* fix: prototype pollution vulnerability in extend (CVE-2024-45435)

Fixes #1427.
https://nvd.nist.gov/vuln/detail/CVE-2024-45435
https://gist.github.com/tariqhawis/c67177164d3b7975210caddb25b60d62

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

---------

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

Author: andersk

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
           files: ./coverage/lcov.info
           fail_ci_if_error: true
       - name: Collect artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: "failure() && matrix.stage != 'unit'"
         with:
           name: Image snapshots (${{ matrix.stage }})

.github/workflows/update-storyshots.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Update snapshots
         run: pnpm test:storyshots -u
       - name: Collect artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: always()
         with:
           name: Updated storyshots

src/core/optionsProvider.ts

@@ -30,7 +30,7 @@ export function optionsProvider<T = unknown>(
       responsiveOptions.forEach(responsiveOption => {
         const mql = window.matchMedia(responsiveOption[0]);
         if (mql.matches) {
-          currentOptions = extend(currentOptions, responsiveOption[1]);
+          currentOptions = extend({}, currentOptions, responsiveOption[1]);
         }
       });
     }

src/utils/extend.ts

@@ -11,7 +11,11 @@ export function extend<T, A, B>(target: T, a: A, b: B): T & A & B;
 export function extend(target: any = {}, ...sources: any[]) {
   for (let i = 0; i < sources.length; i++) {
     const source = sources[i];
+    const targetProto = Object.getPrototypeOf(target);
     for (const prop in source) {
+      if (targetProto !== null && prop in targetProto) {
+        continue; // prevent prototype pollution
+      }
       const sourceProp = source[prop];
       if (
         typeof sourceProp === 'object' &&