Every plain object inherits from one shared object, Object.prototype: it's where methods like toString and hasOwnProperty come from. Prototype pollution is a security bug in which input from outside the program, such as a query string, a form field's name, or a JSON request body, gets code to write a property onto Object.prototype. From then on, every object in the program seems to have that property.
The way in is a few special key names. On a plain object, obj.__proto__ isn't an ordinary property: it's a getter and setter, inherited from Object.prototype, that reads or replaces the object's prototype. So obj["__proto__"] is Object.prototype itself, and a property written through it is written for everyone:
const settings = {};
const key = "__proto__"; // imagine it came from a query string
settings[key].isAdmin = true; // settings.__proto__ is Object.prototype
({}).isAdmin; // true: every object has it now
const user = { name: "Ada" };
user.isAdmin; // true, though user never had the property
delete Object.prototype.isAdmin; // clean up
constructor and prototype lead to the same place: obj.constructor is Object, and Object.prototype is the shared prototype. Here's where a function that sets a value at a dotted path would write, if it followed each key as given:
| Path | Following it reaches | The value lands on |
|---|---|---|
user.isAdmin | obj.user, an ordinary nested object | obj.user, as intended |
__proto__.isAdmin | obj.__proto__, which is Object.prototype | Object.prototype, so every object |
constructor.prototype.isAdmin | obj.constructor, which is Object, then Object.prototype | Object.prototype, so every object |
Why it's a security bug: code often checks a property that's normally missing, like if (user.isAdmin), and after pollution every object passes. Replacing an inherited method, such as toString, can also make code all over the app throw. Bugs like this have been found and fixed in popular libraries, Lodash and jQuery among them.
One more detail. Assigning obj["__proto__"] = value on a plain object doesn't create a key named __proto__: it replaces obj's prototype with value, or does nothing if value isn't an object or null. JSON.parse, though, does create an ordinary key named __proto__, so parsed JSON can carry one into code that copies or merges keys:
const parsed = JSON.parse('{"__proto__": {"isAdmin": true}}');
Object.keys(parsed); // ["__proto__"]: a real own key, harmless so far
const target = {};
target["__proto__"] = parsed["__proto__"]; // replaces target's prototype
Object.keys(target); // []: no key was created
target.isAdmin; // true, inherited from its new prototype
Write unflattenObject(object), the reverse of flattening. Each key of object is a dotted path, and the new object you return has each value at its path.
unflattenObject({ "user.name": "Ada", "user.tags.0": "math", "user.tags.1": "code", active: true });
// { user: { name: "Ada", tags: ["math", "code"] }, active: true }
Go through the entries in order. When a step along a path is missing or isn't an object, put a new container there: an array if the next key is an array index (digits only), a plain object otherwise. Values are used as they are, by reference.
Skip any entry whose path contains the key __proto__, constructor, or prototype, so a flat object from user input can't pollute Object.prototype. Don't change object.
expect(unflattenObject({ "a.b": 1, "a.c.d": 2, e: 3 })).toEqual({ a: { b: 1, c: { d: 2 } }, e: 3 });
expect(unflattenObject({ "list.0.name": "a", "list.1.name": "b" })).toEqual({ list: [{ name: "a" }, { name: "b" }] });
expect(unflattenObject({ "a.1x": 1, "b.-1": 2 })).toEqual({ a: { "1x": 1 }, b: { "-1": 2 } });
const empty = {};
const when = new Date(0);
const result = unflattenObject({ "a.0": 1, b: empty, "c.when": when });
expect(result).toEqual({ a: [1], b: {}, c: { when: new Date(0) } });
expect(result.b).toBe(empty);
expect(result.c.when).toBe(when);
expect(unflattenObject({ a: 1, "a.b": 2 })).toEqual({ a: { b: 2 } });
expect(unflattenObject({ a: null, "a.0": "x" })).toEqual({ a: ["x"] });
try {
const result = unflattenObject({
"__proto__.polluted": 1,
"constructor.prototype.polluted": 1,
"a.__proto__.polluted": 1,
ok: 2,
});
expect(({}).polluted).toBeUndefined();
expect(result).toEqual({ ok: 2 });
} finally {
delete Object.prototype.polluted;
}
const input = { "a.b": 1 };
expect(unflattenObject(input)).not.toBe(input);
expect(input).toEqual({ "a.b": 1 });
expect(unflattenObject({})).toEqual({});
Run tests runs every test on your code, here in your browser. The problem is solved when they all pass.
Ctrl + Enter runs the tests (⌘ + Enter on a Mac).
I'm here to help with Unflatten an object. I give hints, never the solution, so you get to solve it yourself. Ask for a hint, select code to ask about it, or press Ask Tuto why on a failing test.
Your first 3 answers need no account. for free to keep asking.