bug: prevent prototype pollution in chat.add message merge

[devin-ai-integration]

Summary

chat.add merged the untrusted req.body.message straight into the outgoing message with _.merge on lodash 4.17.4, so a body like {"message":{"__proto__":{"canDelete":true}}} polluted Object.prototype and granted every user the delete permission checked in chat.delete.

The merge is replaced by an allow-listed copy — no recursive merge of attacker-controlled keys reaches the target:

const message = Object.assign(
  { icon: '👋' },
  pickMessageFields(req.body.message),   // own, string-valued `text`/`icon` only
  { id: lastId++, timestamp: Date.now(), userName: user.name });

Defense in depth on the same path:

• chat.delete now requires an own canDelete === true on the user record, so a polluted prototype can't grant it.
• findUser rejects non-string name/password (blocks {"$ne": null}-style objects).
• lodash bumped 4.17.4 → 4.17.21 (the version that fixes the merge pollution CVEs) in package.json and both package-lock.json sections; the require('lodash') in routes/index.js is dropped since nothing else uses it.

tests/chat.prototype-pollution.test.js covers __proto__ (built with JSON.parse, since an object-literal __proto__ key isn't an own property), constructor.prototype, field allow-listing, the delete denial, and non-string credentials. 5/5 pass; they fail on main.

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review