webapp-design-prototype-review

--| | 1 | POST /api/merge proto | EJS escapeFunction | Template render | RCE | | 2 | POST /api/profile proto | isAdmin property | Auth middleware | Privilege Escalation | | 3 | URL ?proto[innerHTML] | innerHTML property | DOM write | Client-Side XSS |

Remediation

• Use Object.create(null) for configuration objects instead of {}
• Freeze Object.prototype with Object.freeze(Object.prototype)
• Sanitize proto and constructor keys in user input
• Use Map instead of plain objects for user-controlled data
• Update vulnerable npm packages (lodash, merge-deep, etc.)