# Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

- Prevalence: Média 1 linguagens cobertas
- Impact: Alto 1 regras de severidade alta
- Prevention: Documentada 2 exemplos de correção

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

By modifying the prototype of base objects like Object.prototype, attackers can affect all objects that inherit from these prototypes, potentially leading to code execution or denial of service.

## Prevention

Estratégias de prevenção para Prototype Pollution baseadas em 2 regras de detecção do Shoulder.

### JavaScript

Filter dangerous keys (__proto__, constructor, prototype) or use schema validation before merging user input

Use Object.hasOwn() to verify authorization properties are own properties, not inherited from a polluted prototype

## Warning Signs

- [HIGH] user input flowing to object merge operations without filtering dangerous keys
- [MEDIUM] authorization checks that trust properties without verifying they are own properties

## Consequences

- Executar código não autorizado
- Modificar dados da aplicação
- DoS

## Mitigations

- Use Object.create(null) para objetos de lookup
- Valide e sanitize as chaves antes de atribuir a um objeto
- Use Map em vez de objetos simples para chaves controladas pelo usuário

## Detection

- Total rules: 2
- Languages: javascript, typescript

## Rules by Language

### Javascript (2 rules)

- **Prototype Pollution via Object Manipulation** [HIGH]: Detects user input flowing to object merge operations without filtering dangerous keys.
  - Remediation: Filter dangerous keys (__proto__, constructor, prototype) before merging objects.

```javascript
const BLOCKED = ['__proto__', 'constructor', 'prototype'];
const filtered = Object.fromEntries(
  Object.entries(input).filter(([k]) => !BLOCKED.includes(k))
);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-1321/prototype-pollution
- **Prototype Pollution Gadget - Unsafe Property Trust** [MEDIUM]: Detects authorization checks that trust properties without verifying they are own properties.
  - Remediation: Use Object.hasOwn() to verify properties are not inherited from prototype.

```javascript
if (Object.hasOwn(user, 'isAdmin') && user.isAdmin) {
  grantAccess();
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-1321/prototype-pollution-gadget

### Typescript (2 rules)

- **Prototype Pollution via Object Manipulation** [HIGH]: Detects user input flowing to object merge operations without filtering dangerous keys.
  - Remediation: Filter dangerous keys (__proto__, constructor, prototype) before merging objects.

```javascript
const BLOCKED = ['__proto__', 'constructor', 'prototype'];
const filtered = Object.fromEntries(
  Object.entries(input).filter(([k]) => !BLOCKED.includes(k))
);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-1321/prototype-pollution
- **Prototype Pollution Gadget - Unsafe Property Trust** [MEDIUM]: Detects authorization checks that trust properties without verifying they are own properties.
  - Remediation: Use Object.hasOwn() to verify properties are not inherited from prototype.

```javascript
if (Object.hasOwn(user, 'isAdmin') && user.isAdmin) {
  grantAccess();
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-1321/prototype-pollution-gadget