FrontendHaltJavaScript·Advanced·Coding·1 min read
What is prototype pollution?
Short interview answer
It is modification of a shared prototype through unsafe handling of keys such as __proto__, constructor, or prototype. Inherited attacker-controlled values can alter authorization or configuration logic. Validate keys, use safe merge utilities, and prefer null-prototype dictionaries where appropriate.
Example
// Unsafe deep-merge lets a payload reach Object.prototype:merge({}, JSON.parse('{"__proto__": {"isAdmin": true}}'));({}).isAdmin; // true — every plain object is now affected
// Safer: reject dangerous keys, or use Object.create(null) dictionaries.Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.