Every plain object inherits from one shared object, Object.prototype: it's where methods like toString and hasOwnProperty come from. Prototype pollution is a security bug in which input from outside the program, such as a query string, a form field's name, or a JSON request body, gets code to write a property onto Object.prototype. From then on, every object in the program seems to have that property.
The way in is a few special key names. On a plain object, obj.__proto__ isn't an ordinary property: it's a getter and setter, inherited from Object.prototype, that reads or replaces the object's prototype. So obj["__proto__"] is Object.prototype itself, and a property written through it is written for everyone:
const settings = {};
const key = "__proto__"; // imagine it came from a query string
settings[key].isAdmin = true; // settings.__proto__ is Object.prototype
({}).isAdmin; // true: every object has it now
const user = { name: "Ada" };
user.isAdmin; // true, though user never had the property
delete Object.prototype.isAdmin; // clean up
constructor and prototype lead to the same place: obj.constructor is Object, and Object.prototype is the shared prototype. Here's where a function that sets a value at a dotted path would write, if it followed each key as given:
| Path | Following it reaches | The value lands on |
|---|---|---|
user.isAdmin | obj.user, an ordinary nested object | obj.user, as intended |
__proto__.isAdmin | obj.__proto__, which is Object.prototype | Object.prototype, so every object |
constructor.prototype.isAdmin | obj.constructor, which is Object, then Object.prototype | Object.prototype, so every object |
Why it's a security bug: code often checks a property that's normally missing, like if (user.isAdmin), and after pollution every object passes. Replacing an inherited method, such as toString, can also make code all over the app throw. Bugs like this have been found and fixed in popular libraries, Lodash and jQuery among them.
One more detail. Assigning obj["__proto__"] = value on a plain object doesn't create a key named __proto__: it replaces obj's prototype with value, or does nothing if value isn't an object or null. JSON.parse, though, does create an ordinary key named __proto__, so parsed JSON can carry one into code that copies or merges keys:
const parsed = JSON.parse('{"__proto__": {"isAdmin": true}}');
Object.keys(parsed); // ["__proto__"]: a real own key, harmless so far
const target = {};
target["__proto__"] = parsed["__proto__"]; // replaces target's prototype
Object.keys(target); // []: no key was created
target.isAdmin; // true, inherited from its new prototype
Write set(object, path, value). It writes value at path inside object, creating whatever is missing on the way. It changes object in place and returns it.
path is a string like "a.b[0].c", or an array of keys like ["a", "b", 0, "c"]. Objects already on the path are kept and written into. When a step is missing or holds something that isn't an object (a number, null), put a new container there: an array if the next key is an array index (digits only, like 0 or "12"), and a plain object otherwise.
Paths can come from user input, so guard against prototype pollution: if any key in the path is __proto__, constructor, or prototype, change nothing and return object.
set({}, "user.tags[0]", "js"); // { user: { tags: ["js"] } }
set({ a: { x: 1 } }, "a.y", 2); // { a: { x: 1, y: 2 } }
set({ a: 1 }, ["a", "b"], 2); // { a: { b: 2 } }
set({}, "__proto__.admin", true); // {}, and Object.prototype is untouched
expect(set({}, "a.b.c", 1)).toEqual({ a: { b: { c: 1 } } });
expect(set({}, "list[0].name", "x")).toEqual({ list: [{ name: "x" }] });
expect(set({}, ["a", 0, "b"], 1)).toEqual({ a: [{ b: 1 }] });
expect(set({}, "a.1x", 1)).toEqual({ a: { "1x": 1 } });
expect(set({}, ["b", "-1"], 2)).toEqual({ b: { "-1": 2 } });
const inner = { x: 1 };
const o = { a: inner, other: true };
set(o, "a.y", 2);
expect(o.a).toBe(inner);
expect(o).toEqual({ a: { x: 1, y: 2 }, other: true });
expect(set({ a: 1 }, "a.b", 2)).toEqual({ a: { b: 2 } });
expect(set({ a: null }, "a[0]", "x")).toEqual({ a: ["x"] });
const o = { keep: true };
expect(set(o, "added", 1)).toBe(o);
expect(o).toEqual({ keep: true, added: 1 });
const target = {};
try {
set(target, "__proto__.polluted", true);
set(target, ["constructor", "prototype", "polluted"], true);
set(target, "a.__proto__.polluted", true);
expect(({}).polluted).toBeUndefined();
expect(target).toEqual({});
} finally {
delete Object.prototype.polluted;
}
Run tests runs every test on your code, here in your browser. The problem is solved when they all pass.
Ctrl + Enter runs the tests (⌘ + Enter on a Mac).
I'm here to help with Set by path. I give hints, never the solution, so you get to solve it yourself. Ask for a hint, select code to ask about it, or press Ask Tuto why on a failing test.
Your first 3 answers need no account. for free to keep asking.