codejump
HardPro challengeJavaScriptTypeScript

Fix Prototype Pollution

Node.jsSecurityObjects

The function below performs a deep merge of two objects, but it is vulnerable to prototype pollution — one of the most dangerous Node.js security issues.

The bug: an attacker can pass { "__proto__": { "admin": true } } as the source, and the admin property gets injected onto every object in the process — including ones that should not have it.

Your task: fix solve(target, source) so that:

  • Normal merges still work correctly.
  • Keys like __proto__, constructor, and prototype are silently skipped.
solve({ a: 1 }, { b: 2 })
// → { a: 1, b: 2 }  ✅

solve({}, { "__proto__": { "admin": true } })
// → {}  ✅  (prototype NOT polluted — {}.admin stays undefined)

Sample tests

Test #1Normal flat merge
Input: [{"a":1},{"b":2}]
Output: {"a":1,"b":2}
Test #2Deep merge of nested objects
Input: [{"nested":{"x":1}},{"nested":{"y":2}}]
Output: {"nested":{"x":1,"y":2}}
Test #3Merge into empty target
Input: [{},{"a":1,"b":{"c":2}}]
Output: {"a":1,"b":{"c":2}}
Test #4Source value overrides target
Input: [{"a":1},{"a":99}]
Output: {"a":99}
← All challenges