Prototype Pollution

// Node.js/Express - SECURE against prototype pollution

// Utility to filter dangerous keys recursively
function sanitizeObject(obj) {
  const dangerousKeys = ['__proto__', 'constructor', 'prototype'];
  
  if (typeof obj !== 'object' || obj === null) return obj;
  
  if (Array.isArray(obj)) {
    return obj.map(sanitizeObject);
  }
  
  const sanitized = {};
  for (const key in obj) {
    if (obj.hasOwnProperty(key) && !dangerousKeys.includes(key)) {
      sanitized[key] = sanitizeObject(obj[key]);
    }
  }
  return sanitized;
}

const appConfig = {
  theme: 'light',
  language: 'en',
  features: {}
};

app.post('/api/settings', authenticateToken, (req, res) => {
  // SECURE: Whitelist allowed fields, no deep merge
  const allowedFields = ['theme', 'language', 'timezone'];
  const updates = {};
  
  for (const field of allowedFields) {
    if (req.body[field] !== undefined) {
      // Coerce to expected type
      updates[field] = String(req.body[field]);
    }
  }
  
  Object.assign(appConfig, updates);
  res.json({ message: 'Settings updated', config: appConfig });
});

app.get('/api/admin/users', authenticateToken, (req, res) => {
  // SECURE: Explicit permission check, not relying on object properties
  const userId = req.user.id;
  
  // Check against database or explicit role system
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Admin only' });
  }
  
  res.json(getAllUsers());
});

// SECURE: Use JSON round-trip to remove prototype pollution
app.patch('/api/preferences', (req, res) => {
  // JSON round-trip removes __proto__ and other dangerous keys
  const sanitizedInput = JSON.parse(JSON.stringify(req.body));
  
  // Additional sanitization
  const safeInput = sanitizeObject(sanitizedInput);
  
  // Whitelist specific fields
  const userPrefs = {
    notifications: Boolean(safeInput.notifications),
    email_updates: Boolean(safeInput.email_updates),
    theme: String(safeInput.theme || 'light')
  };
  
  res.json(userPrefs);
});

// ALTERNATIVE: Use null-prototype objects for maps
app.post('/api/user-data', (req, res) => {
  // Create object with no prototype
  const userData = Object.create(null);
  
  // Safe to assign - no prototype chain to pollute
  userData.name = req.body.name;
  userData.email = req.body.email;
  
  res.json(userData);
});