Protect against prototype pollution in import action

[davetsay]

Closes #7089

Describe your changes:

remove __proto__ when parsing JSON from import action

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Is this change backwards compatible? For example, developers won't need to change how they are calling the API or how they've extended core plugins such as Tables or Plots.

Author Checklist

• Changes address original issue?
• Tests included and/or updated with changes?
• Command line build passes?
• Has this been smoke tested?
• Testing instructions included in associated issue OR is this a dependency/testcase change?

Reviewer Checklist

• Changes appear to address issue?
• Reviewer has tested changes by following the provided instructions?
• Changes appear not to be breaking changes?
• Appropriate automated tests included?
• Code style and in-line documentation are appropriate?
• Has associated issue been labelled unverified? (only applicable if this PR closes the issue)
• Has associated issue been labelled bug? (only applicable if this PR is for a bug fix)

[codecov]

Codecov Report

Merging #7094 (596e8c5) into master (3c7d339) will increase coverage by 0.19%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #7094      +/-   ##
==========================================
+ Coverage   55.45%   55.64%   +0.19%     
==========================================
  Files         649      650       +1     
  Lines       26060    26063       +3     
  Branches     2547     2547              
==========================================
+ Hits        14451    14504      +53     
+ Misses      10907    10858      -49     
+ Partials      702      701       -1     

Flag	Coverage Δ		*Carryforward flag
e2e-full	41.93% <ø> (+<0.01%)	⬆️	Carriedforward from 3c7d339
e2e-stable	57.27% <50.00%> (+0.08%)	⬆️
unit	49.16% <100.00%> (+0.15%)	⬆️

*This pull request uses carry forward flags. Click here to find out more.

Files	Coverage Δ
...ugins/importFromJSONAction/ImportFromJSONAction.js	65.26% <100.00%> (+41.85%)	⬆️
...plugins/localStorage/LocalStorageObjectProvider.js	100.00% <100.00%> (ø)
src/utils/sanitization.js	100.00% <100.00%> (ø)

... and 7 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3c7d339...596e8c5. Read the comment docs.

[deploysentinel]

Current Playwright Test Results Summary

✅ 14 Passing

Run may still be in progress, this comment will be updated as current testing workflow or job completes...

(Last updated on 10/02/2023 09:48:47pm UTC)

Run Details

Running Workflow e2e-couchdb on Github Actions

Commit: 596e8c5

Started: 10/02/2023 09:46:52pm UTC

View Detailed Build Results

---

Current Playwright Test Results Summary

✅ 140 Passing - ⚠️ 2 Flaky

Run may still be in progress, this comment will be updated as current testing workflow or job completes...

(Last updated on 10/02/2023 09:48:47pm UTC)

Run Details

Running Job e2e-stable on CircleCI

Commit: 596e8c5

Started: 10/02/2023 09:21:24pm UTC

⚠️ Flakes

📄   functional/plugins/plot/logPlot.e2e.spec.js • 1 Flake

Test Case Results

Test Case	Last 7 days Failures	Last 7 days Flakes
Log plot tests Log Plot ticks are functionally correct in regular and log mode and after refresh Retry 1 • Initial Attempt	7.87% (7) 7 / 89 runs failed over last 7 days	23.60% (21) 21 / 89 runs flaked over last 7 days

---

📄   functional/plugins/notebook/notebookSnapshots.e2e.spec.js • 1 Flake

Test Case Results

Test Case	Last 7 days Failures	Last 7 days Flakes
Snapshot image tests Can drop an image onto a notebook and create a new entry Retry 1 • Initial Attempt	16.09% (14) 14 / 87 runs failed over last 7 days	60.92% (53) 53 / 87 runs flaked over last 7 days

---

View Detailed Build Results

---

[unlikelyzero]

Can you add a functional and negative test scenario for this in the e2e suite

[shefalijoshi]

Curious if we can use Vue's utility method here instead?

[davetsay]

Curious if we can use Vue's utility method here instead?

I think we should try to keep view/Vue code out of the logic paths if possible.

[shefalijoshi]

Looks fine!

[ozyx]

Looks like there's a new memory leak? thus the failing perf test

[davetsay]

Looks like there's a new memory leak? thus the failing perf test

I re-ran the tests and perf passes. I don't think this introduced a leak.