Module 49 // Core JavaScript

Language-Level Security

Module Objective

Prototype pollution, object hardening, defensive patterns

Mental Model Realtime Simulation

INTERACTIVE_CANVAS
Editor_Pane
Loading...
Console_Output
Waiting for output...

Practical Code Examples

// Example 1
// 1. Prototype Pollution
const maliciousPayload = JSON.parse('{"__proto__": {"isAdmin": true}}');
const target = {};

Object.assign(target, maliciousPayload);

console.log({}.isAdmin); // true! (Oops!)
💡 Prototype pollution happens when an attacker can inject properties into the base `Object.prototype`. This can change the behavior of every object in your app.
// Example 2
// 2. Preventing Pollution
const db = Object.create(null); 

// Now 'db' has no __proto__. 
// Pollution cannot reach it.
db.user = "Subhajit";
💡 Objects created with `Object.create(null)` don't inherit from `Object.prototype`. They are 'Pure Map' objects and are safe from prototype-based attacks.
// Example 3
// 3. Object Hardening
const CONFIG = { apiKey: "123" };
Object.freeze(CONFIG);

CONFIG.apiKey = "HACKED"; // No effect
console.log(CONFIG.apiKey); // "123"
💡 `Object.freeze()` prevents any modification to an object. This is essential for protecting shared configuration or constants.

Engine & Memory Architecture

Protection Mechanisms

1. Immutable Buffers:

  • When an object is frozen, the engine marks its memory block as Read-Only in the Heap.
  • Any write attempt triggers a trap that immediately stops the operation (and throws in Strict Mode).

2. Slot Protection:

  • The engine can hide specific Internal Slots (like [[Prototype]]) from being accessed via standard string keys, preventing easy pollution.

3. Execution Realms:

  • For maximum security, untrusted scripts should be run in a separate Realm (like a Worker or Sandboxed Iframe) so they cannot touch the Main Thread's Global Object.
PREVIOUS_MODULEeval & Dynamic Code ExecutionNEXT_MODULE Legacy & Edge Syntax