Schutz vor Prototype Pollution in React State-Update-Handlern

import { useState } from 'react';
 
const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
export function SecureNestedForm() {
  const [profile, setProfile] = useState(() => Object.create(null));
 
  const handleDeepFieldUpdate = (keyPath, value) => {
    if (FORBIDDEN_KEYS.has(keyPath)) {
      throw new TypeError(`Restricted property assignment: ${keyPath}`);
    }
 
    setProfile((prev) => {
      const sanitizedKey = String(keyPath).trim();
      return Object.freeze({
        ...prev,
        [sanitizedKey]: typeof value === 'string' ? value.slice(0, 100) : value
      });
    });
  };
 
  return (
    <input
      aria-label="User Bio"
      onChange={(e) => handleDeepFieldUpdate('bio', e.target.value)}
      value={profile.bio || ''}
    />
  );
}