fix(merge-allof-schema-properties): avoid file content disclosure

packages/ruleset/src/utils/merge-allof-schema-properties.js

@@ -8,6 +8,12 @@ const { isObject, mergeWith } = require('lodash');
 // Takes a schema, and if an allOf field is provided,
 // merges all allOf schema properties to create one schema
 function mergeAllOfSchemaProperties(schema) {
+  // Type guard: reject non-object input before applying 'in' operator
+  // This prevents TypeError when schema is a string (e.g., resolved file contents)
+  if (typeof schema !== 'object' || schema === null) {
+    return schema;
+  }
+
   // Bail out immediately if 'schema' has no "allOf" field.
   if (!('allOf' in schema)) {
     return schema;

packages/ruleset/test/utils/merge-allof-schema-properties.test.js

@@ -291,4 +291,22 @@ describe('Utility function: mergeAllOfSchemaProperties()', () => {
 
     expect(mergeAllOfSchemaProperties(schema)).toStrictEqual(expectedResult);
   });
+
+  it('should safely handle non-object input (security: CWE-209)', async () => {
+    // Test with string input (simulates resolved file contents)
+    const stringInput = 'random_string_input';
+    expect(mergeAllOfSchemaProperties(stringInput)).toBe(stringInput);
+
+    // Test with null input
+    expect(mergeAllOfSchemaProperties(null)).toBe(null);
+
+    // Test with undefined input
+    expect(mergeAllOfSchemaProperties(undefined)).toBe(undefined);
+
+    // Test with number input
+    expect(mergeAllOfSchemaProperties(42)).toBe(42);
+
+    // Test with boolean input
+    expect(mergeAllOfSchemaProperties(true)).toBe(true);
+  });
 });