Object Prototype is not Your Friend

Gagik Papikyan, Senior Software Engineer at DataArt. He started out as a full-stack developer, then moved into backend, and along the way has worn every hat — from individual contributor to team lead, and even startup co-founder. Object Prototype Pollution is a JavaScript vulnerability that occurs when an attacker is able to modify properties of the base object prototype. Since almost every object in JavaScript inherits from this shared prototype, injecting or overwriting properties on it can change the behavior of the entire application at once. Protection is built around safe practices: validating and sanitizing input keys, freezing prototypes, and using safer data structures.