Polución de prototipos (Prototype Pollution) en JavaScript y Node.js: guía de prevención para 2026

// A dangerous merge function
function merge(target, source) {
  for (const key of Object.keys(source)) {
    if (source[key] && typeof source[key] === 'object') {
      if (!target[key]) target[key] = {};
      merge(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

const userInput = JSON.parse('{"__proto__": {"isAdmin": true}}');
const config = merge({}, userInput);   // ⚠️ pollutes Object.prototype!
console.log({}.isAdmin);               // → true  (every object is now "admin")

// Backend code checking admin status
function isAdmin(user) {
  return user.role === 'admin';
}

// Attacker sends: {"__proto__": {"role": "admin"}}
// After a recursive merge, every object has role === 'admin'
// isAdmin({}) → true

// Older JavaScript engines allowed getter injection
const payload = '{"__proto__": {"toString": {"__defineGetter__": "..."}}';
// Can hang the process when any object is coerced to string

// Next.js server component receives polluted query params
// Object.prototype now has .dangerous = "value",
// which shadows expected properties in component props

// A schema validator checks allowed properties
const allowed = ['name', 'email', 'role'];
function sanitize(obj) {
  const clean = {};
  for (const key of allowed) {
    if (key in obj) clean[key] = obj[key];
  }
  return clean;
}

// After prototype pollution, 'isAdmin' is always "in" obj
// because it's inherited via prototype, even though it's not own
'isAdmin' in {}  // → true after pollution

// ✅ Immune to prototype pollution
const config = Object.create(null);

// ✅ Safe for caches, lookup tables, user-data maps
const userCache = Object.create(null);
userCache[sessionId] = userData;

// ✅ Safe for parsed query parameters
const params = Object.create(null);
params[key] = value;

// ✅ Safe merge with explicit prototype key exclusion
function safeMerge(target, ...sources) {
  const PROTOTYPE_KEYS = new Set([
    '__proto__',
    'constructor',
    'prototype',
  ]);

  for (const source of sources) {
    for (const key of Object.keys(source)) {
      if (PROTOTYPE_KEYS.has(key)) continue;     // 🛡️ skip dangerous keys
      if (!Object.prototype.hasOwnProperty.call(source, key)) continue;
      // ^ also skip inherited properties that might be from a previous pollution

      const val = source[key];
      if (val && typeof val === 'object' && !Array.isArray(val)) {
        target[key] = safeMerge(
          Object.prototype.hasOwnProperty.call(target, key)
            ? target[key]
            : Object.create(null),
          val
        );
      } else {
        target[key] = val;
      }
    }
  }
  return target;
}

// ❌ DANGEROUS — 'key in obj' checks the prototype chain
if ('isAdmin' in userData) { /* may be true even without own property */ }

// ✅ SAFE — only checks own properties
if (Object.prototype.hasOwnProperty.call(userData, 'isAdmin')) {
  // truly own
}

// ✅ or with Object.hasOwn() (ES2022+)
if (Object.hasOwn(userData, 'isAdmin')) {
  // truly own
}

// ✅ Map is safe — keys are entries, not properties
const cache = new Map();
cache.set(userInputKey, value);
// No __proto__ attack possible

// ✅ Safer for rate-limiting buckets, session stores, memoization

// ✅ Limit recursion depth to prevent prototype chain traversal
function safeDeepClone(obj, maxDepth = 5) {
  const seen = new WeakMap();

  function clone(value, depth) {
    if (depth > maxDepth) return Object.create(null);   // 🛡️ cap depth
    if (value === null || typeof value !== 'object') return value;

    if (seen.has(value)) return seen.get(value);

    const cloneTarget = Array.isArray(value) ? [] : Object.create(null);
    seen.set(value, cloneTarget);

    for (const key of Object.keys(value)) {
      if (key === '__proto__' || key === 'constructor') continue;  // 🛡️
      if (Object.prototype.hasOwnProperty.call(value, key)) {
        cloneTarget[key] = clone(value[key], depth + 1);
      }
    }
    return cloneTarget;
  }

  return clone(value, 0);
}

import { z } from 'zod';
// or: ajv, yup, joi

const UserSchema = z.object({
  name: z.string().max(100),
  email: z.string().email(),
  role: z.enum(['user', 'admin']).optional(),
  // ⚠️ No __proto__, constructor, or prototype fields allowed
}).strict();   // 🛡️ .strict() rejects unknown keys

app.post('/api/user', (req, res) => {
  // Parse BEFORE any merge or spread — rejection if __proto__ present
  const result = UserSchema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ error: 'Invalid payload' });
  }
  // Now it's safe to use the parsed data
});

// apps/my-app/src/lib/query-parser.ts

// ❌ DANGEROUS — Object.assign or spread inherits prototype
// const params = { ...req.query };

// ✅ SAFE — extract only expected keys
export function parseSafeQuery(query: Record<string, string>, allowed: string[]) {
  const params: Record<string, string> = Object.create(null);
  for (const key of allowed) {
    if (typeof query[key] === 'string') {
      params[key] = query[key];
    }
  }
  return params;
}

// apps/my-app/src/actions/user.ts
'use server';

export async function updateProfile(formData: FormData) {
  // FormData entries are already safe (they don't carry __proto__),
  // but if you convert to JSON, be careful
  const raw = Object.fromEntries(formData.entries());  // ⚡ safe — entries are strings
  const data = ProfileSchema.parse(raw);               // 🛡️ validate!
}

// apps/my-app/src/middleware.ts
export function middleware(request: NextRequest) {
  const contentType = request.headers.get('content-type');
  if (contentType?.includes('application/json')) {
    // Next.js will parse the JSON body — ensure depth limits
    // by configuring bodyParser in next.config or using a custom parser
  }
}

// next.config.ts
import type { NextConfig } from 'next';

const nextConfig: NextConfig = {
  experimental: {
    serverComponentsBodySizeLimit: '1mb',
  },
  // Body parser depth limit for API routes
  // (configure via custom middleware if needed)
};

# Run Node with frozen intrinsics to prevent prototype mutation
node --frozen-intrinsics server.js