chore: 릴리즈 — CodeQL 속성 주입 지적 실질 해소 (fromEntries 전환)

[chanwoo7]

릴리즈 개요

직전 릴리즈(#199)에 포함됐던 CodeQL 수정의 후속 1건을 릴리즈합니다.
develop → main이며, 포함된 변경은 PR #200 하나입니다.

배경

PR #196의 키 블록리스트 가드는 실제 오염은 막지만, main 재분석 결과 CodeQL js/remote-property-injection이 이를 sanitizer로 인식하지 않아 알림 3건이 열린 채 유지됐습니다.
경고 대상인 할당식 속성 쓰기(out[key] = ...)를 entries 배열 + Object.fromEntries로 대체해 소스 자체를 제거했습니다.
define-property 의미라 __proto__류 키로도 프로토타입을 오염시킬 수 없어 방어도 더 강해집니다.

검증

• PR #200의 CodeQL 분석(PR ref)에서 results_count 0 — 알림 3건 해소를 머지 전 확인.
• 기존 단위 테스트 12건 동작 동일 통과, Codex 👍 + 필수 체크 pass로 develop 머지됨.

[coderabbitai]

Warning

Review limit reached

@chanwoo7, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 76d8cc7b-c9ef-49ce-980a-86f3dfccfa71

📥 Commits

Reviewing files that changed from the base of the PR and between d3e4d49 and a6889c7.

📒 Files selected for processing (1)

• src/common/utils/url-query.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🩺 NestJS Doctor — 89/100 (Good)

진단 279건 (error 0).

Category	error	warning	info
architecture	0	0	13
correctness	0	126	0
performance	0	24	17
schema	0	0	86
security	0	13	0

architecture / security 상위 항목

• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'IAuditLogRepository'.
• warning security/security/no-exposed-env-vars: Direct 'process.env.NODE_ENV' access in 'AuthController'. Use ConfigService instead.
• warning security/security/require-guards-on-endpoints: Endpoint 'start' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'callback' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'refresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'logout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogin' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerRefresh' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogout' has no @UseGuards() at class or method level.
• warning security/security/require-guards-on-endpoints: Endpoint 'devIssueToken' has no @UseGuards() at class or method level.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/conversation/repositories/conversation.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'ConversationRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/order/repositories/order.repository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'OrderRepository'.
• info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal module '@/features/product/repositories/product.repository'.

오탐 포함 가능 · 기준 docs/guide/architecture-conventions.md

[github-actions]

🧹 knip — dead-code 리포트

요약 항목 없음

전체 리포트

(knip 출력 없음 — 이슈 0이거나 실행 실패)

청소 후보(오탐 가능) · 기준 docs/guide/architecture-conventions.md

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/common/utils/url-query.ts	85.71%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	97.61%	4772/4889
🟢	Branches	93.96%	1928/2052
🟢	Functions	95.99%	933/972
🟢	Lines	98.21%	4339/4418

Test suite run success

1574 tests passing in 184 suites.

Report generated by 🧪jest coverage report action from a6889c7