fix(core): treat backslashes as metadata key segment boundaries

Run metadata operations now reject JSON-path keys that use escaped dots
to reach `__proto__`, `constructor` or `prototype`.

Mono-RevId: 4f3837f181c84d71543994d234e52c52ca225f1d

Author: ericallam

.changeset/metadata-key-escaped-segments.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Run metadata operations now reject JSON-path keys that use escaped dots to reach `__proto__`, `constructor` or `prototype`.

packages/core/src/v3/schemas/common.ts

@@ -9,15 +9,16 @@ const DANGEROUS_METADATA_KEY_SEGMENTS = new Set(["__proto__", "constructor", "pr
 
 /**
  * Prototype-pollution guard for run metadata operation keys. JSON paths are applied via
- * JSONHeroPath, so dangerous path segments must be rejected. Literal keys are assigned directly,
- * where only __proto__ can change the target object's prototype.
+ * JSONHeroPath, so dangerous path segments must be rejected. JSONHeroPath unescapes `\.` when it
+ * parses a path and re-splits on it when it writes, so backslashes are segment boundaries too.
+ * Literal keys are assigned directly, where only __proto__ can change the target object's prototype.
  */
 export function isSafeMetadataKey(key: string): boolean {
   if (!key.startsWith("$.")) {
     return key !== "__proto__";
   }
 
-  return !key.split(/[.[\]'"]+/).some((segment) => DANGEROUS_METADATA_KEY_SEGMENTS.has(segment));
+  return !key.split(/[.[\]'"\\]+/).some((segment) => DANGEROUS_METADATA_KEY_SEGMENTS.has(segment));
 }
 
 const MetadataOperationKey = z.string().refine(isSafeMetadataKey, {

packages/core/test/runMetadataOperations.test.ts

@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, test } from "vitest";
+import { applyMetadataOperations } from "../src/v3/runMetadata/operations.js";
+import { isSafeMetadataKey, UpdateMetadataRequestBody } from "../src/v3/schemas/index.js";
+import type { RunMetadataChangeOperation } from "../src/v3/schemas/index.js";
+
+const unsafeKeys = [
+  "$.__proto__.polluted",
+  "$.__proto__\\.polluted",
+  "$.a\\.__proto__\\.polluted",
+  "$.a.__proto__\\.polluted",
+  "$.constructor\\.prototype\\.polluted",
+  "$.a\\\\.__proto__.polluted",
+];
+
+describe("run metadata operation keys", () => {
+  afterEach(() => {
+    delete (Object.prototype as Record<string, unknown>).polluted;
+  });
+
+  test.each(unsafeKeys)("rejects %s", (key) => {
+    expect(isSafeMetadataKey(key)).toBe(false);
+    expect(
+      UpdateMetadataRequestBody.safeParse({ operations: [{ type: "set", key, value: 41 }] }).success
+    ).toBe(false);
+  });
+
+  test.each(unsafeKeys)("does not change Object.prototype through %s", (key) => {
+    const operations: RunMetadataChangeOperation[] = [
+      { type: "set", key, value: 41 },
+      { type: "append", key, value: 41 },
+      { type: "increment", key, value: 41 },
+      { type: "remove", key, value: 41 },
+    ];
+
+    const { unappliedOperations } = applyMetadataOperations({ a: {} }, operations);
+
+    expect(unappliedOperations).toHaveLength(operations.length);
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+  });
+
+  test("allows escaped dots around safe segments", () => {
+    expect(isSafeMetadataKey("$.a\\.b")).toBe(true);
+    expect(isSafeMetadataKey("$.proto\\.constructors")).toBe(true);
+  });
+});