Prototype pollution: source, propagation, and gadget

Mechanism

JavaScript property lookups can inherit values through the prototype chain. Pollution modifies shared prototype state when a merge or path setter accepts special property names without a safe ownership policy. The pollution source is only the first part: impact requires a reachable consumer that trusts an inherited property in a security-sensitive operation.

Practical method

Trace how nested input becomes object keys and whether it touches a shared prototype. In a local fixture, use a distinctive inert marker and check a newly created object. Then audit consumers for inherited property reads, default options, and dynamic configuration. Separate pollution of one object from pollution of a globally shared prototype.

const options = Object.create(null);
options.timeout = 1000;
if (Object.hasOwn(userOptions, "timeout")) {
  options.timeout = userOptions.timeout;
}

Interpreting evidence

The marker appearing on an unrelated object demonstrates shared-state mutation. It does not demonstrate execution. A complete finding identifies the property name, the reachable gadget, the operation it influences, and whether a fresh request or process is required.

Pitfalls and limits

Blocking proto alone may leave constructor/prototype paths. Null-prototype dictionaries help only where they are actually used. Pollution can survive between requests in long-lived processes and make later experiments misleading.