Fix code scanning alert - Prototype-polluting assignment

Pain

The alert this issue links now reads Fixed, which is misleading: the finding was renumbered, not resolved. The prototype-polluting assignment in the search indexer is open on main today.

Field names come from a customer's own schema, and TinaCloud's server side index rebuild feeds that schema into the indexer. A field named proto with a subfield toString deletes Object.prototype.toString process wide.

️ Approach

• Guard the field name before using it as a key, so proto and constructor cannot reach the prototype

✅ Acceptance Criteria

• Alert 61 no longer reports on main
• A collection with a field named proto or constructor indexes without touching Object.prototype
• A regression test covers the delete case and the assignment case

Related

• Open alert: https://github.com/tinacms/tinacms/security/code-scanning/61
• Original alert, superseded by the one above: https://github.com/tinacms/tinacms/security/code-scanning/30
• Renumbered by https://github.com/tinacms/tinacms/pull/6259