Pollution via a nested path

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

Now the developer blocks __proto__ and constructor, but checks only the top-level keys. The merge is recursive, so if you nest __proto__ inside another object it passes the shallow check and pollutes as the merge descends.

What you are looking at

The same settings page; the filter blocks __proto__ and constructor but only at the top level. The recursive merge descends into objects and picks up the dangerous key at a deeper level.

Goal

Pollute the prototype with a nested key that bypasses the shallow check.

What counts as solved

You polluted the prototype via a nested path.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Try the key at the top level and note it is blocked.
Note the check is shallow while the merge is recursive.
Nest __proto__ inside another object.
Open the panel and confirm the pollution.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

A shallow check does not see the dangerous key when nested, and the recursive merge reaches it on the way down. The fix is checking every key at every depth, not the top level alone.

The root cause

The check is shallow while the merge is recursive, so a nested key slips through. The root is not checking keys at every depth.

How the code is fixed

Check dangerous keys at every depth, not only the top level.

Vulnerable code

// Only the top-level keys are checked; nested __proto__ slips past.
for (const key of Object.keys(source)) if (depth === 0 && BAD.has(key)) continue;

Safe code

// Check dangerous keys at EVERY depth of the recursion.
for (const key of Object.keys(source)) if (BAD.has(key)) continue;

Impact in the real world

Bypassing a shallow check with a nested path has reintroduced prototype pollution in real merge libraries.

How defenders detect it

Defenders check dangerous keys at every depth, prefer null-prototype objects or Map, and test that properties do not change.

Back to the lesson