Prototype pollution workaround

by Arnaud Buchholz

HTML

<p>Open the JavaScrip tab</p>

JavaScript

function vulnerability1 () {
  try {
    const obj = {}
    obj.__proto__ = { property1: true }
    console.log('❌ vulnerable :', obj.property1)
  } catch (e) {
    console.log('✔️ secured')
  }
}

function vulnerability2 () {
  try {
    const obj = {}
		Object.assign(obj, JSON.parse('{"__proto__":{"property2":true}}'))
    console.log('❌ vulnerable :', obj.property2)
  } catch (e) {
    console.log('✔️ secured')
  }
}

vulnerability1()
vulnerability2()

Object.defineProperty(Object.prototype, '__proto__', {
  get () { throw new Error('__proto__ get')},
  set () { throw new Error('__proto__ set')}
})

vulnerability1()
vulnerability2()