🛡️ Sentinel: [HIGH] Fix Path Traversal and Prototype Pollution vulnbts

[harrydbarnes]

🚨 Severity: HIGH
💡 Vulnerability:

1. The static file server did not decode URI components before validating path traversal, allowing directory escape via encoded payloads (e.g., %2e%2e).
2. The JSON persistence mechanism merged config using the spread operator without sanitization, leaving a defensive gap for Prototype Pollution.

🎯 Impact:

1. Path Traversal: Attackers could read arbitrary files on the host filesystem (like /etc/passwd).
2. Prototype Pollution: While object spread has mitigation, it is unsafe to merge unsanitized parsed JSON structures.

🔧 Fix:

1. Applied decodeURIComponent and path.resolve bound checks to the serveStatic router in server.js.
2. Converted the spread merge to a manual loop that ignores __proto__, constructor, and prototype in server.js and vite.config.js.

✅ Verification:

• Server accurately restricts /%2e%2e/%2e%2e/etc/passwd to a 403 Forbidden.
• The React App serves normally.
• Prototype pollution JSON payloads ignore __proto__ entirely on persistence.