Intermediate LevelWeb Security & Cyber Defense
What is Prototype Pollution in JavaScript and how do you protect Object.assign / deep merge functions?
❓ Interview Prompt: Explain Prototype Pollution, `__proto__`, `constructor.prototype`, recursive object merging vulnerability, and defenses (`Object.create(null)`).
Prototype Pollution is a JavaScript vulnerability where un-sanitized user JSON modifies 'Object.prototype', adding or overriding properties across ALL objects in the runtime:
Attack Payload:
'{ "__proto__": { "isAdmin": true } }'
If parsed by a vulnerable deep-merge function, '({}).isAdmin' becomes 'true' across the application!
Defenses:
1
'Object.create(null)': Create dictionary objects without prototype chains.
2
Freeze Prototype: Call 'Object.freeze(Object.prototype)' at application startup.
3
Map Data Structure: Use ES6 'Map' instead of plain objects for dynamic key-value storage.
Code Implementation Example
typescript
import lodash from 'lodash';
// ❌ Vulnerable custom recursive merge function:
// function unsafeMerge(target, source) { for (let key in source) target[key] = source[key]; }
// ✅ SECURE: Use updated Lodash merge or Object.create(null)
const safeDictionary = Object.create(null);
safeDictionary.name = 'Alice'; // No __proto__ chain exists!💡Creating dictionary objects without prototype chains using Object.create(null).
🎯 Interview Key Takeaway
Use Object.create(null) or Object.freeze(Object.prototype) to prevent JavaScript prototype pollution exploits.
#Prototype Pollution#JavaScript Security#Node.js#Intermediate
Back to all Web Security & Cyber Defense Questions→