Potential fix for code scanning alert no. 1: Prototype-polluting function

[NullSablex]

Potential fix for https://github.com/NullSablex/PawnPro/security/code-scanning/1

In general, prototype pollution in deep-assignment functions is mitigated by (a) blocking dangerous key names such as __proto__, constructor, and prototype, and (b) only traversing / extending objects that are verified to be safe (typically, “plain objects”), refusing to follow a chain into anything else. This ensures an attacker cannot redirect the traversal into Object.prototype or another sensitive object and then write properties on it.

For this specific setKey implementation in src/core/config.ts, we already have step (a): a forbidden list checked against every component of dotPath. The best additional safeguard, without changing existing functionality, is to ensure that cursor is always a plain object during the traversal and before the final write. We can do this by:

1. In the traversal loop, replacing the current if (!isPlainObject(cursor[key])) { cursor[key] = {}; } with logic that:
   • If cursor[key] exists but is not a plain object, we overwrite it with a new empty plain object rather than traversing into it.
   • Always set cursor to the newly created or existing plain object.
2. Before the final assignment (cursor[parts[parts.length - 1]] = value;), verifying that cursor itself is a plain object. If not, we either replace it safely or throw an error. To preserve current behavior (which is to always make the path writable), the least disruptive approach is to ensure during the loop that cursor is always a plain object; that makes an extra check before the final write unnecessary.
3. Optionally, add a small defensive check that the last path segment is not one of the forbidden prototype-pollution keys as well. The existing parts.some(...) check already covers it globally, so no extra logic is actually needed there.

We should reuse the existing isPlainObject helper from this file and not introduce new dependencies. The edits will all be within the setKey method: around lines 146–154. No new imports are required; no external packages are necessary.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.