fix(plugin-node-server): harden query/params against prototype pollution (CodeQL)

CodeQL flagged remote property injection: query-param keys come straight
from the request URL, so building the map on a plain object literal let
'?__proto__=…' write through the prototype chain. Use null-prototype
objects for query and params and drop the dangerous keys
(__proto__/constructor/prototype) outright; regression test pins that
'?__proto__=polluted' is dropped and Object.prototype stays clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A1BtxNeUaGmvUYr8FwtUNu

Author: claude

packages/plugins/plugin-node-server/src/adapter.test.ts

@@ -140,6 +140,15 @@ describe('NodeHttpServer (live socket)', () => {
         expect(await res.text()).toBe('');
     });
 
+    it('drops prototype-polluting query keys (CodeQL: remote property injection)', async () => {
+        const res = await fetch(`${base}/echo/1?__proto__=polluted&constructor=x&a=ok`);
+        expect(res.status).toBe(200);
+        const body = await res.json();
+        expect(body.q).toEqual({ a: 'ok' });
+        // The global Object prototype must be untouched.
+        expect(({} as any).polluted).toBeUndefined();
+    });
+
     it('exposes the Host header natively (no backfill needed)', async () => {
         server.get('/host', (req, res) => { res.json({ host: req.headers.host }); });
         const res = await fetch(`${base}/host`);

packages/plugins/plugin-node-server/src/adapter.ts

@@ -160,7 +160,9 @@ export class NodeHttpServer implements IHttpServer {
             if (route.method !== effective) continue;
             const m = route.regex.exec(normalized);
             if (!m) continue;
-            const params: Record<string, string> = {};
+            // Null-prototype for symmetry with `query` — keys come from the
+            // registered pattern (developer-controlled), values from the URL.
+            const params: Record<string, string> = Object.create(null);
             route.keys.forEach((k, i) => { params[k] = decodeURIComponent(m[i + 1]); });
             return { route, params };
         }
@@ -198,8 +200,13 @@ export class NodeHttpServer implements IHttpServer {
         }
 
         // ── Query params (multi-value aware) ────────────────────────────────
-        const query: Record<string, string | string[]> = {};
+        // Null-prototype object + dangerous-key filter: the property names
+        // come straight from the request, so a plain `{}` would be open to
+        // prototype pollution via `?__proto__=…` (CodeQL: remote property
+        // injection).
+        const query: Record<string, string | string[]> = Object.create(null);
         for (const key of url.searchParams.keys()) {
+            if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
             if (key in query) continue;
             const all = url.searchParams.getAll(key);
             query[key] = all.length > 1 ? all : all[0];