fix(common): 쿼리 키의 프로토타입 오염 위험 속성 쓰기 차단

[chanwoo7]

배경

CodeQL code scanning의 js/remote-property-injection(high) 3건 반영입니다.
toQueryParams가 사용자 쿼리 문자열의 키를 그대로 객체 속성으로 써서(out[key] = ...) __proto__ 같은 위험 키가 속성 이름으로 유입될 수 있었습니다.
사용처가 HTTP 요청 메타 로깅(request-context.ts) 1곳의 로컬 객체라 실질 위험은 낮지만, 지적은 정당하고 수정 비용이 작아 차단합니다.

변경점

• __proto__/constructor/prototype 키는 변환에서 제외.
• CodeQL이 sanitizer로 인식하는 패턴을 따르기 위해 Set 조회가 아닌 명시적 키 비교 사용.

검증

• 순수 단위 테스트 1건 추가(위험 키 제외), 스위트 12건 통과.
• 알림 3건은 이 수정이 main에 반영된 뒤 CodeQL 재분석 시 자동 종료 예상.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d7909b78-a0ad-46d0-b313-50651de11f50

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🩺 NestJS Doctor — 89/100 (Good)

진단 279건 (error 0).

Category	error	warning	info
architecture	0	0	13
correctness	0	126	0
performance	0	24	17
schema	0	0	86
security	0	13	0

architecture / security 상위 항목

• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'IAuditLogRepository'.
• warning security/security/no-exposed-env-vars: Direct 'process.env.NODE_ENV' access in 'AuthController'. Use ConfigService instead.
• warning security/security/require-guards-on-endpoints: Endpoint 'start' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'callback' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'refresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'logout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogin' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerRefresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'devIssueToken' has no @UseGuards() at class or method level.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/conversation/repositories/conversation.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'ConversationRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/order/repositories/order.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'OrderRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/product/repositories/product.repository'.

오탐 포함 가능 · 기준 docs/guide/architecture-conventions.md

[github-actions]

🧹 knip — dead-code 리포트

요약 항목 없음

전체 리포트

(knip 출력 없음 — 이슈 0이거나 실행 실패)

청소 후보(오탐 가능) · 기준 docs/guide/architecture-conventions.md

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	97.61%	4772/4889
🟢	Branches	93.29%	1530/1640
🟢	Functions	95.99%	933/972
🟢	Lines	98.21%	4339/4418

Test suite run success

1574 tests passing in 184 suites.

Report generated by 🧪jest coverage report action from cd2c01a

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!