JavaScript · Senior · Question 33 of 75
What's dangerous about a deep-merge function applied to user-supplied JSON?
merge({}, JSON.parse('{"__proto__": {"isAdmin": true}}'));- ✓Correct answer: Prototype pollution: the property ends up in
Object.prototype - 2It overflows the stack on any nested JSON data
- 3Nothing:
JSON.parseautomatically strips dangerous internal keys
Explanation
A naive merge assigns target.__proto__.isAdmin = true, and ({}).isAdmin becomes true across the whole app. Protection: skip __proto__, constructor, prototype, use Object.create(null) or Map for dictionaries, validate input with a schema.