chore(repo): use null-prototype bag in ucp totals extraction

Author: jithinraj

packages/mappings/ucp/src/mapper.ts

@@ -49,27 +49,31 @@ function deriveOrderStatus(order: UcpOrder): 'completed' | 'partial' | 'processi
 }
 
 /**
- * Extract totals by type from a UCP order. The inline literal guards before
- * each property assignment are the recognized data-flow barrier pattern for
- * preventing prototype-chain pollution from a remote-controlled `total.type`:
- * the assignment is reached only when `total.type` is a non-empty string and
- * is not one of the three built-in property names that could otherwise
- * pollute the prototype chain or shadow a built-in slot. The returned bag
- * is a normal object (Object.prototype) so JSON serialization, snapshot
- * tests, and downstream `Object.getPrototypeOf` / property-helper consumers
- * behave exactly as they did before this barrier was introduced.
+ * Extract totals by type from a UCP order. Defense-in-depth against
+ * prototype-chain pollution from a remote-controlled `total.type`:
+ *
+ *   1. Property writes go to a null-prototype bag (`Object.create(null)`)
+ *      so there is no prototype chain that a malicious key could reach.
+ *   2. Inline literal guards still drop the three forbidden built-in
+ *      property names from the output before assignment, so the bag never
+ *      carries those keys even as own properties.
+ *   3. The bag is materialized into a normal-prototype Object via a
+ *      JSON round-trip so the public payload shape preserves
+ *      `Object.getPrototypeOf === Object.prototype` semantics for
+ *      downstream consumers (JSON serialization, snapshot tests, and
+ *      property-helper consumers).
  */
 function extractTotals(order: UcpOrder): Record<string, MinorUnits> {
-  const result: Record<string, MinorUnits> = {};
+  const bag: Record<string, MinorUnits> = Object.create(null);
 
   for (const total of order.totals) {
     const key = total.type;
     if (typeof key !== 'string' || key.length === 0) continue;
     if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
-    result[key] = total.amount;
+    bag[key] = total.amount;
   }
 
-  return result;
+  return JSON.parse(JSON.stringify(bag)) as Record<string, MinorUnits>;
 }
 
 /**