Keep untrusted object keys out of prototype and authority paths

JavaScript property lookup can continue through an object’s prototype when an own property is absent. A prototype-pollution defect lets untrusted keys influence a write into that shared structure. Its impact appears later when unrelated code reads an inherited value as an option, authority field or other trusted input.

The supplied project has both halves: a recursive profile merge follows inherited __proto__ or constructor.prototype objects, then a weak admin check trusts session.isAdmin. The test process observes the actual shared-prototype change and restores it after each case. This demonstrates the language behavior locally; whether a particular package or endpoint is affected needs its own test.

JSON.parse can create an own property named __proto__ without changing the global prototype. The dangerous step is later dynamic assignment or recursion. A shallow setter-triggering assignment may change just the target’s prototype; a recursive traversal through an inherited object can reach Object.prototype itself. Identify which object is modified instead of treating every occurrence of the string as equivalent.

In the starter, target[key] || {} reuses an inherited object. For key=constructor, an ordinary object resolves the Object constructor; its prototype property leads to Object.prototype. Blocking only __proto__ leaves this second path. Object spread does not invoke the __proto__ setter the way assignment can, but spreading attacker fields still does not validate them or make them trustworthy.

This profile endpoint needs only displayName and preferences.theme. Accept a nonblank bounded string for displayName and an enumerated light/dark theme. Reject extra keys and wrong shapes at both levels. Construct a new result from the explicitly allowed fields; there is no product requirement to recursively apply arbitrary paths.

The distinction matters for testing. An isAdmin field should fail because it is not part of a profile update, even when it would be an ordinary own property and causes no prototype mutation; /fix/mass-assignment/ shows that repair for each common stack. A nested object where a string is expected should fail before downstream code uses it. Schema enforcement closes the accepted input contract, while prototype controls address object behavior.

The module below is the project's reference solution in readable form. mergeProfile builds a fresh null-prototype record from the two allowed fields, canAdmin accepts only an own boolean true, and labelsDictionary keeps arbitrary labels as inert data. It passes the project's 18 tests.

// profile-boundary.mjs: the repaired boundaries, readable form of the project's reference.
const isRecord = value => value !== null && typeof value === 'object' && !Array.isArray(value);

function allowKeys(value, allowed) {
  if (!isRecord(value) || Object.keys(value).some(key => !allowed.includes(key)))
    throw new Error('Invalid profile schema');
}

// Build a fresh record from the allowed fields; never merge arbitrary paths.
export function mergeProfile(profile, patch) {
  allowKeys(patch, ['displayName', 'preferences']);
  const result = Object.create(null);
  result.displayName = profile.displayName;
  result.preferences = Object.create(null);
  result.preferences.theme = profile.preferences.theme;
  if (Object.hasOwn(patch, 'displayName')) {
    const name = patch.displayName;
    if (typeof name !== 'string' || name.trim().length < 1 || name.length > 80)
      throw new Error('Invalid displayName');
    result.displayName = name;
  }
  if (Object.hasOwn(patch, 'preferences')) {
    allowKeys(patch.preferences, ['theme']);
    if (Object.hasOwn(patch.preferences, 'theme')) {
      if (!['light', 'dark'].includes(patch.preferences.theme)) throw new Error('Invalid theme');
      result.preferences.theme = patch.preferences.theme;
    }
  }
  return result;
}

// session is server-created state; only an own boolean true grants admin.
export function canAdmin(session) {
  return isRecord(session) && Object.hasOwn(session, 'isAdmin') && session.isAdmin === true;
}

// Arbitrary labels stay inert data in a dictionary with no prototype.
export function labelsDictionary(entries) {
  const dictionary = Object.create(null);
  for (const [key, value] of entries) {
    if (typeof key !== 'string' || key.length > 80 || typeof value !== 'string' || value.length > 200)
      throw new Error('Invalid label');
    dictionary[key] = value;
  }
  return dictionary;
}

Object.create(null) makes a dictionary without an inherited prototype chain. In this project, labelsDictionary intentionally stores the string keys __proto__, constructor and hasOwnProperty as inert own data. It accepts bounded string values and never interprets those labels as options, method names, paths or grants. A Map is another suitable representation for arbitrary key/value data.

The dictionary is safe within that declared use, not universally sanitized. Copying its arbitrary keys into another ordinary object with a setter-triggering merge can reintroduce a problem. Keep the representation and downstream contract intact. A null-prototype dictionary also lacks inherited convenience methods; use Object.hasOwn(dictionary, key) to inspect membership.

The admin decision in this project requires Object.hasOwn(session, "isAdmin") and session.isAdmin === true. An inherited true, a string "true" and a number 1 are all denied. Object.hasOwn also works when an object has no prototype or an own field named hasOwnProperty. Calling session.hasOwnProperty directly would trust a method supplied by that object.

This check is meaningful only for server-created authenticated session state. A submitted JSON object containing its own isAdmin:true is still attacker-controlled. Do not route a validated profile patch into authorization. Session ownership, revocation and resource-specific permission (/domains/appsec/authorization/object-level-authorization/) remain separate checks; own-property testing establishes a property’s location, not its legitimacy.

Pollution becomes dangerous when trusted code reads an option it never set. The Silent Spring study (USENIX Security 2023) found 11 such universal gadgets in core Node.js APIs, for example process-spawning options, and used them for eight remote code execution exploits in the npm CLI, Parse Server and Rocket.Chat. Treat any unchecked options object, template setting or environment map as a possible gadget, and keep merge, path-setting and query-parsing libraries patched.

Runtime hardening narrows the paths but does not replace the schema. In a test on Node.js 26 with a recursive merge, --disable-proto=delete stopped the __proto__ payload and --disable-proto=throw made it throw, but the constructor.prototype payload polluted Object.prototype under both flags. Freezing intrinsics, with Object.freeze(Object.prototype) or the experimental --frozen-intrinsics flag, made both payloads throw, at the cost of breaking code that modifies built-ins.

CVE-2019-10744 was a prototype pollution in lodash below 4.17.12: defaultsDeep could be tricked with a constructor payload into modifying Object.prototype for the whole process. The missing control was rejecting __proto__ and constructor keys before merging, as this guide does.

The project’s 18 tests preserve valid name/theme changes and genuine admin sessions while rejecting top-level and nested pollution routes, unknown fields, wrong scalar types and inherited grants. A dedicated test first pollutes the prototype independently of the merge, then exercises authorization. That proves the read-side defense still works if another component introduces a mutation.

Run node --test exercise.test.mjs in the extracted project with Node.js 22 or 24; Node.js 20 reached end of life on 30 April 2026. Repair exercise.mjs and keep the tests intact. After attempting the fix, compare reference.mjs or run EXERCISE_MODULE=reference node --test exercise.test.mjs. The suite uses no dependencies or network. Treat runtime hardening and maintained dependencies as additional protections, not substitutes for the schema and policy repairs.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. MDN — JavaScript prototype pollution
2. MDN — Object.hasOwn
3. MDN — Object.create
4. OWASP — Prototype Pollution Prevention Cheat Sheet
5. CWE-1321 — Improperly controlled prototype modification. CWE 4.20.
6. Node.js: --disable-proto and --frozen-intrinsics. Node.js v26.11.1.
7. Shcherbakov, Balliu and Staicu: Silent Spring, prototype pollution leads to RCE in Node.js (USENIX Security 2023)
8. Node.js release schedule
9. NVD: CVE-2019-10744, prototype pollution in lodash

Reference information

Node.js 22 or 24 for the local project; Node.js 20 is end of life. Merge libraries and framework versions differ, so test the one you use.

Tags

Access controlInput validation and parsingJavaScript and Node.js

SDLC phase

Development

Role

DevelopersAppSec engineers

ASVS 5.0.0 requirements

v5.0.0-15.3.6 · v5.0.0-15.3.3

Download this guide as Markdown

Continue exploring