feat: Phoenix builder agentic pieces for phoenix to build itself

[abose]

No description provided.

In general, to fix unvalidated dynamic method calls, we should ensure that the property name derived from untrusted data is validated against a known set of allowed values, or at least check that the looked-up property is an own property and that its value is a function before invoking it. This prevents unexpected prototype methods or non-functions from being called and avoids runtime exceptions from malformed inputs.

Here, the best targeted fix is to guard the call to handlers[msg.type](msg) with checks that (1) msg.type is a string, (2) handlers actually has that key as an own property (not via the prototype chain), and (3) the resulting value is a function. If any of these checks fail, we simply ignore the message (or could add optional logging) without throwing. This preserves existing behavior for valid messages, while safely handling malicious or malformed ones.

Concretely, in src/phoenix-builder/phoenix-builder-boot.js, in the ws.onmessage handler around lines 251–264, replace the current dispatch block:

// Dispatch to registered handler, or built-in defaults
if (msg.type && handlers[msg.type]) {
    handlers[msg.type](msg);
} else if (msg.type === "ping") {
    _sendMessage({ type: "pong" });
}

with a safer version that uses Object.prototype.hasOwnProperty.call and a function-type check:

// Dispatch to registered handler, or built-in defaults
if (typeof msg.type === "string" &&
    Object.prototype.hasOwnProperty.call(handlers, msg.type) &&
    typeof handlers[msg.type] === "function") {
    handlers[msg.type](msg);
} else if (msg.type === "ping") {
    _sendMessage({ type: "pong" });
}

This change stays within the shown snippet, adds no new imports, and does not alter visible functionality for correct inputs.

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE