fix(core): sanitize object keys in deepCopy to prevent prototype pollution

[XananasX7]

Description

This Pull Request fixes a critical Prototype Pollution vulnerability in the deepCopy utility within @angular-devkit/core.

Technical Details

The current implementation of deepCopy recursively iterates over object properties using Object.getOwnPropertyNames without sanitizing sensitive keys. An attacker can provide a malicious configuration (e.g., in angular.json) containing __proto__, constructor, or prototype keys to pollute the global Object.prototype. In Node.js environments, this can lead to Remote Code Execution (RCE) by overwriting inherited properties used by task runners.

Fix

Implemented a security check within the recursive loop to skip sensitive keys (__proto__, constructor, prototype), ensuring the integrity of the prototype chain.

Reference: Google Issue Tracker #506079652

[gemini-code-assist]

Code Review

This pull request enhances the deepCopy utility by adding a security check to prevent prototype pollution. It explicitly skips the proto, constructor, and prototype keys during object cloning. I have no feedback to provide.