Verhinderung von Prototype-Pollution-Angriffen bei dynamischer JSON-Deserialisierung

export function safeReviver(key, value) {
  if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
    throw new TypeError(`Forbidden property key detected during parsing: ${key}`);
  }
  return Object.freeze(value && typeof value === 'object' ? Object.setPrototypeOf(value, null) : value);
}
 
export function parseSveltePayload(jsonString) {
  try {
    return JSON.parse(jsonString, safeReviver);
  } catch (err) {
    console.error('Payload validation failure:', err.message);
    return Object.create(null);
  }
}