Harden campaign import handling

webui/src/features/campaigns/utils/draftEditor.ts

@@ -1,5 +1,5 @@
 import type { CampaignVersionDetail } from "../../../api/campaigns";
-import { asRecord, getCampaignJson, isRecord } from "./campaignView";
+import { asRecord, getCampaignJson, isRecord, isSafeObjectPathSegment } from "./campaignView";
 
 export type DraftPatch = (draft: Record<string, unknown>) => Record<string, unknown>;
 
@@ -46,19 +46,32 @@ export function updateNested(
   path: string[],
   value: unknown
 ): Record<string, unknown> {
+  if (!path.length || !path.every(isSafeObjectPathSegment)) return cloneJson(draft);
   const next = cloneJson(draft);
   let current: Record<string, unknown> = next;
-  path.forEach((segment, index) => {
+  for (const [index, segment] of path.entries()) {
     if (index === path.length - 1) {
-      current[segment] = value;
-      return;
+      Object.defineProperty(current, segment, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+      });
+      break;
     }
-    const existing = current[segment];
+    const existing = Object.getOwnPropertyDescriptor(current, segment)?.value;
     if (!isRecord(existing)) {
-      current[segment] = {};
+      Object.defineProperty(current, segment, {
+        configurable: true,
+        enumerable: true,
+        value: {},
+        writable: true
+      });
     }
-    current = current[segment] as Record<string, unknown>;
-  });
+    const child = Object.getOwnPropertyDescriptor(current, segment)?.value;
+    if (!isRecord(child)) return next;
+    current = child;
+  }
   return next;
 }