News for hackers. Stuff that matters.
Re:Prototype-Poisoning by efortis on Tuesday October 24, 2023 @10:29PM (#38008455)
The mitigation is simple, use `null` as prototype:

     Object.create(null)
instead of

     {}

For example,

    function PersonModel(person) {
      const p = Object.assign(Object.create(null), person)
      p.name ??= ''
      p.age ??= 0
      return p
    }
    
    const p1 = new PersonModel(JSON.parse('{"b": 5, "__proto__": { "c": 6 }}'))
    p1.c // undefined

There are no comments on this comment yet.