Guard deepMerge against prototype pollution

[gunjanjaswal]

The basics

• I validated my changes

The details

Resolves

Fixes #10048

Proposed Changes

deepMerge walks source with for...in and never skips the prototype-pollution keys, so a source object with an own enumerable __proto__ (which is exactly what JSON.parse produces) gets written onto Object.prototype during the recursive merge. This adds a small guard that skips __proto__, constructor, and prototype before merging each key.

Reason for Changes

Blockly.utils.object.deepMerge is a public, package-root-reachable API. If a host app passes any user-influenced data through it, deepMerge({}, JSON.parse('{"__proto__":{"x":"y"}}')) sets Object.prototype.x, which then leaks onto every plain object in the process (CWE-1321). The guard is minimal and leaves behavior unchanged for all normal keys.

Test Coverage

Added a case to the existing deepMerge mocha suite in utils_test.js: it merges a JSON.parse('{"__proto__": {"blocklyPolluted": "yes"}}') payload into {} and asserts Object.prototype.blocklyPolluted stays undefined. It fails before the guard and passes after. I don't have the Blockly build toolchain set up locally, so I leaned on the added test plus CI rather than a local full run.

Documentation

None needed, behavior is unchanged for normal keys.

Additional Information

On #10048 a maintainer mentioned you might prefer to drop deepMerge in favor of the spread operator. Happy to do that instead if you'd rather remove the function than harden it; this guard is the minimal fix in the meantime.

[github-actions]

Welcome! It looks like this is your first pull request in Blockly, so here are a couple of tips:

• You can find tips about contributing to Blockly and how to validate your changes on our developer site.
• We use conventional commits to make versioning the package easier. Make sure your commit message is in the proper format or learn how to fix it.
• If any of the other checks on this PR fail, you can click on them to learn why. It might be that your change caused a test failure, or that you need to double-check the style guide.
  Thank you for opening this PR! A member of the Blockly team will review it soon.