JavaScript Prototype Chain Manipulation
Overview
Beyond basic __proto__ assignment, prototype chain attacks include:
- Setting properties on
Object.prototypevia indirect paths - Using
constructor.prototypeto poison objects Object.setPrototypeOf()with attacker-controlled objects- Vulnerable deserialization that constructs objects on attacker-defined chains
Remediation
- Freeze base object prototypes in security-sensitive code:
Object.freeze(Object.prototype) - Use
Object.create(null)for pure hash maps - Validate all keys before property assignment