fix(common): 쿼리 파라미터 변환을 fromEntries로 전환해 CodeQL 지적 실질 해소

[chanwoo7]

배경

PR #196의 키 블록리스트 가드는 실제 오염은 막지만, main 재분석 결과 CodeQL js/remote-property-injection이 이를 sanitizer로 인식하지 않아 알림 3건이 그대로 열려 있습니다(지적 라인만 가드 추가분만큼 이동).
경고 대상인 할당식 속성 쓰기 자체를 제거하는 방식으로 다시 수정합니다.

변경점

• out[key] = ... 대신 entries 배열을 모아 Object.fromEntries로 변환.
  define-property 의미라 __proto__류 키로도 프로토타입을 오염시킬 수 없어 방어 자체도 더 강해집니다.
• 위험 키(__proto__/constructor/prototype) 제외 필터는 유지.

검증

• 기존 단위 테스트 12건 그대로 통과 (동작 동일).
• 머지 전 이 PR의 CodeQL 분석(ref=PR head)에서 해당 알림 3건이 사라지는지 확인 예정.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a4c35764-69ec-45e1-a34b-e159edcb4c2d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧹 knip — dead-code 리포트

요약 항목 없음

전체 리포트

(knip 출력 없음 — 이슈 0이거나 실행 실패)

청소 후보(오탐 가능) · 기준 docs/guide/architecture-conventions.md

[github-actions]

🩺 NestJS Doctor — 89/100 (Good)

진단 279건 (error 0).

Category	error	warning	info
architecture	0	0	13
correctness	0	126	0
performance	0	24	17
schema	0	0	86
security	0	13	0

architecture / security 상위 항목

• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'IAuditLogRepository'.
• warning security/security/no-exposed-env-vars: Direct 'process.env.NODE_ENV' access in 'AuthController'. Use ConfigService instead.
• warning security/security/require-guards-on-endpoints: Endpoint 'start' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'callback' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'refresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'logout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogin' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerRefresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'devIssueToken' has no @UseGuards() at class or method level.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/conversation/repositories/conversation.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'ConversationRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/order/repositories/order.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'OrderRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/product/repositories/product.repository'.

오탐 포함 가능 · 기준 docs/guide/architecture-conventions.md

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/common/utils/url-query.ts	85.71%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	97.61%	4772/4889
🟢	Branches	93.96%	1928/2052
🟢	Functions	95.99%	933/972
🟢	Lines	98.21%	4339/4418

Test suite run success

1574 tests passing in 184 suites.

Report generated by 🧪jest coverage report action from ebc828a