How to avoid prototype pollution in javascript?

Question

In javascript, it's possible to "override" properties or methods of Object.prototype. For example:

Object.prototype.toString = function(){
  return "some string";
};

It can break an entire application if not used carefully. Are there any tools, techniques or approaches to avoid this (for example, some kind of 'strict mode' that doesn't allow the developer to override properties of Object)?

Object.freeze(Object.prototype) will help, but again.. don't know how much pollution it will create — Koushik Chatterjee
– Koushik Chatterjee, Commented Jul 22, 2017 at 17:21
A good read for anyone that lands on this question: esdiscuss.org/topic/object-freeze-object-prototype-vs-reality — Ray Toal
– Ray Toal, Commented Jul 22, 2017 at 17:28
@RayToal: Fantastic link, I've added it to the CW answer below. — T.J. Crowder
– T.J. Crowder, Commented Jul 22, 2017 at 17:30
See here on how to do this carefully and not break applications — Bergi
– Bergi, Commented Jul 22, 2017 at 18:01

T.J. Crowder · Accepted Answer · 2017-07-22 17:28:52Z

7

Object.freeze(YourConstructor.prototype) can help protect your constructor's associated prototype object from being mucked with. From MDN:

The Object.freeze() method freezes an object: that is, prevents new properties from being added to it; prevents existing properties from being removed; and prevents existing properties, or their enumerability, configurability, or writability, from being changed, it also prevents the prototype from being changed.

It works on the object itself, rather than making a copy that's frozen. It returns the same reference you pass it.

It's best to leave built-in prototypes alone, so using it on Object.prototype and such may not be a great idea. :-) Certainly you'd need to do a lot of testing if you did... See this thread on the es-discuss mailing list for relevant, useful info.

answered Jul 22, 2017 at 17:28

community wiki

T.J. Crowder

Sign up to request clarification or add additional context in comments.

4 Comments

Koushik Chatterjee Over a year ago

hmm, but a simple thing I want to add (or may be ask), what is the point of doing this if some attack de-refer the Object itself?

Bergi Over a year ago

@KoushikChatterjee These techniques only can help to prevent third parties from accidentally breaking your application. They never can secure it against an attacker. If you have anyone run unrestricted code on your page, you've already lost.

Cookie Over a year ago

+1 because you can lock your doors but you can't put bear traps in your own house, that's not how security works.

Koushik Chatterjee Over a year ago

@Bergi yeah that's the conceptual stuff about XSS , but the point of my comment was, is there any way further to prevent that (though we know, preventing XSS is not at all a good idea because its already too late)

Collectives™ on Stack Overflow

How to avoid prototype pollution in javascript?

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest