bug: fix lodash prototype pollution in PUT /chat (CWE-1321)

[devin-ai-integration]

Summary

Fixes the CWE-1321 prototype pollution reachable through PUT /chat (Snyk inventory vuln_id 83, "Prototype pollution in lodash defaults").

routes/index.js merged the raw request body into a new message object with lodash 4.17.4:

_.merge(message, req.body.message, { id, timestamp, userName })

lodash < 4.17.5 does not filter __proto__, so {"message": {"__proto__": {"canDelete": true}}} sets Object.prototype.canDelete. The in-repo gadget is chat.delete, whose guard is !user.canDelete — after pollution every user (including the low-privileged demo account) inherits canDelete and can delete messages; any other if (obj.someFlag) check in the process is equally affected.

Changes:

• chat.add no longer merges attacker-controlled objects: it copies only own, string-typed text / icon via pickMessageFields, then assigns id / timestamp / userName server-side. The lodash import is dropped (it was the only usage).
• chat.delete requires canDelete to be an own property strictly equal to true, so inherited flags from any future pollution sink cannot grant deletion.
• findUser rejects non-string credentials (blocks operator-object auth payloads).
• lodash bumped 4.17.4 → 4.17.21 in package.json and package-lock.json, removing the vulnerable version itself.

Testing

tests/chat.prototype-pollution.test.js (new): __proto__ and constructor.prototype payloads leave Object.prototype clean, only allow-listed fields are copied, delete stays 403, non-string auth is rejected.

NODE_OPTIONS=--openssl-legacy-provider ./node_modules/.bin/tap tests/chat.prototype-pollution.test.js --no-coverage
# 5/5 pass

---

Requested by the code-scan remediation automation. Devin session: https://app.devin.ai/sessions/916f278a627a4ec188495dd38af4b17a

Devin-Org: engineering