houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove dependency on lodash.pick. (#15213)

Browse Source 
Fixes [Dependabot Alert
85](https://github.com/twentyhq/twenty/security/dependabot/85) -
prototype pollution in lodash.

Added a shared pick helper (with unit tests) in twenty-shared and
refactored front-end/server code to import { pick } from the shared
barrel instead of lodash.pick.

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: martmull <martmull@hotmail.fr>
This commit is contained in:
Abdullah.
2025-10-21 13:19:49 +05:00
committed by GitHub
parent 187cf400aa
commit 793dc3d6fc
14 changed files with 67 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/api/mcp/services/tools/create.tools.service.ts
+10 -6
View File
@@ -1,11 +1,11 @@
import { Injectable } from '@nestjs/common';
import { type Request } from 'express';
import pick from 'lodash.pick';
import { isDefined } from 'twenty-shared/utils';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { MCPMetadataToolsService } from 'src/engine/api/mcp/services/tools/mcp-metadata-tools.service';
import { validationSchemaManager } from 'src/engine/api/mcp/utils/get-json-schema';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { type ObjectName } from 'src/engine/api/rest/metadata/types/metadata-entity.type';
@Injectable()
@@ -39,18 +39,22 @@ export class CreateToolsService {
}
async execute(request: Request, objectName: ObjectName) {
const { fields, objects } = request.body.params.arguments;
const selectors = {
...(isDefined(fields) ? { fields } : {}),
...(isDefined(objects) ? { objects } : {}),
};
const requestContext = {
body: request.body.params.arguments,
baseUrl: this.mCPMetadataToolsService.generateBaseUrl(request),
path: `/rest/metadata/${objectName}`,
headers: request.headers,
};
const response = await this.mCPMetadataToolsService.send(
requestContext,
await this.metadataQueryBuilderFactory.create(
requestContext,
pick(request.body.params.arguments, ['fields', 'objects']),
),
await this.metadataQueryBuilderFactory.create(requestContext, selectors),
);
return response.data.data;
packages/twenty-server/src/engine/api/mcp/services/tools/get.tools.service.ts
+9 -6
View File
@@ -1,10 +1,10 @@
import { Injectable } from '@nestjs/common';
import { type Request } from 'express';
import pick from 'lodash.pick';
import { isDefined } from 'twenty-shared/utils';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { MCPMetadataToolsService } from 'src/engine/api/mcp/services/tools/mcp-metadata-tools.service';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { type ObjectName } from 'src/engine/api/rest/metadata/types/metadata-entity.type';
@Injectable()
@@ -74,6 +74,12 @@ export class GetToolsService {
}
async execute(request: Request, objectName: ObjectName) {
const { fields, objects } = request.body.params.arguments;
const selectors = {
...(isDefined(fields) ? { fields } : {}),
...(isDefined(objects) ? { objects } : {}),
};
const requestContext = {
body: request.body.params.arguments,
baseUrl: this.mCPMetadataToolsService.generateBaseUrl(request),
@@ -84,10 +90,7 @@ export class GetToolsService {
const response = await this.mCPMetadataToolsService.send(
requestContext,
await this.metadataQueryBuilderFactory.get(
requestContext,
pick(request.body.params.arguments, ['fields', 'objects']),
),
await this.metadataQueryBuilderFactory.get(requestContext, selectors),
);
return response.data.data;
packages/twenty-server/src/engine/api/mcp/services/tools/update.tools.service.ts
+9 -7
View File
@@ -2,11 +2,11 @@ import { Injectable } from '@nestjs/common';
import { type Request } from 'express';
import omit from 'lodash.omit';
import pick from 'lodash.pick';
import { isDefined } from 'twenty-shared/utils';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { MCPMetadataToolsService } from 'src/engine/api/mcp/services/tools/mcp-metadata-tools.service';
import { validationSchemaManager } from 'src/engine/api/mcp/utils/get-json-schema';
import { MetadataQueryBuilderFactory } from 'src/engine/api/rest/metadata/query-builder/metadata-query-builder.factory';
import { type ObjectName } from 'src/engine/api/rest/metadata/types/metadata-entity.type';
@Injectable()
@@ -70,7 +70,12 @@ export class UpdateToolsService {
}
async execute(request: Request, objectName: ObjectName) {
const { id, ...body } = request.body.params.arguments;
const { id, fields, objects, ...body } = request.body.params.arguments;
const selectors = {
...(isDefined(fields) ? { fields } : {}),
...(isDefined(objects) ? { objects } : {}),
};
const requestContext = {
body,
baseUrl: this.mCPMetadataToolsService.generateBaseUrl(request),
@@ -80,10 +85,7 @@ export class UpdateToolsService {
const response = await this.mCPMetadataToolsService.send(
requestContext,
await this.metadataQueryBuilderFactory.update(
requestContext,
pick(request.body.params.arguments, ['fields', 'objects']),
),
await this.metadataQueryBuilderFactory.update(requestContext, selectors),
);
return response.data.data;