Q45: What is Prototype Pollution and how do you protect Node.js applications against it?
Prototype Pollution occurs when an attacker modifies the base JavaScript Object.prototype by injecting properties through recursive object merging or path traversal keys like __proto__ or constructor.prototype. To prevent it, use Object.create(null) for plain key-value maps, freeze prototypes with Object.freeze(), validate JSON input schemas, or use modern map structures like Map.
Key Takeaways
- Prototype Pollution manipulates
Object.prototypeto inject unintended properties globally. - Mitigate using
Object.create(null), input validation libraries, orMapdatatypes.
Knowledge Check
Which object creation approach produces an object completely free from Object.prototype inheritance?