防止JavaScript对象原型中毒

时间:2019-07-10 10:31:01

标签: javascript node.js security

我看到有太多潜在的方法可以毒化javascript原型。我们如何以最小的努力来防止这种情况发生。

const { branch_name, store_name, product_name } = req.params;
const { branch_name, store_name, product_name } = axios('some_third_party');
const { branch_name, store_name, product_name } = require('some_other_thing');

// branch_name === "constructor"
// store_name === "prototype"
// product_name === "is_admin"

// inject is_admin === value to prototype of all object
result[branch_name][store_name][product_name] = value;

0 个答案:

没有答案