diff --git a/frontend/src/app/assignment/modules/edit-assignment/task-markdown.service.ts b/frontend/src/app/assignment/modules/edit-assignment/task-markdown.service.ts index 7186847f..083159af 100644 --- a/frontend/src/app/assignment/modules/edit-assignment/task-markdown.service.ts +++ b/frontend/src/app/assignment/modules/edit-assignment/task-markdown.service.ts @@ -21,12 +21,12 @@ export class TaskMarkdownService { continue; } - const {prefix, description, points, _id, glob} = extractTaskItem(match); + // exclude __proto__ from rest to avoid prototype pollution + const {prefix, points, _id, __proto__, ...rest} = extractTaskItem(match); const task: Task = { + ...rest, _id: _id || this.taskService.generateID(), points: +points, - description, - glob, children: [], collapsed: true, };