当使用shineout2.0.11 出现Prototype Pollution in immer <9.0.6

[LinPan-asbuilt]

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of GHSA-9qmh-276g-x5pj when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.