Deserialisierungs-Schutzhülle für unvertrauenswürdige JSON-Datenstrukturen

import { useState, useCallback } from 'react';
 
function sanitizePayload(rawJson) {
  const parsed = JSON.parse(rawJson, (key, value) => {
    if (key === '__proto__' || key === 'constructor') return undefined;
    return value;
  });
  return Object.freeze(Object.assign(Object.create(null), parsed));
}
 
export function useSecurePayloadState(initialJson) {
  const [state, setState] = useState(() => sanitizePayload(initialJson));
  const updatePayload = useCallback((newJson) => {
    setState(sanitizePayload(newJson));
  }, []);
  return [state, updatePayload];
}