javascript / expert
Snippet
Sanitizing Server-Rendered Svelte State against Prototype Pollution
Deserializing untrusted JSON payloads for Svelte SSR hydration can expose applications to prototype pollution if object prototype keys are modified. Utilizing a custom JSON reviver with Reflect.deleteProperty strips dangerous keys during parsing while Object.freeze prevents downstream runtime mutations.
snippet.js
javascript
1
2
3
4
5
6
7
8
9
export function safeDeserializeState(jsonPayload) {return JSON.parse(jsonPayload, (key, value) => {if (key === '__proto__' || key === 'constructor' || key === 'prototype') {Reflect.deleteProperty(value, key);return undefined;}return Object.freeze(value);});}
svelte
Breakdown
1
return JSON.parse(jsonPayload, (key, value) => {
Initiates JSON parsing with a reviver function to evaluate every key-value pair.
2
if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
Checks for special property names commonly exploited in prototype pollution attacks.
3
Reflect.deleteProperty(value, key);
Removes dangerous keys directly from the parsed object structure before assignment.
4
return Object.freeze(value);
Freezes the deserialized object node to prevent unauthorized dynamic object extensions.