2026-09-01 · 6 min read · Rahul Chitturi
- json
- security
- debugging
Valid JSON can still become dangerous when application code recursively merges it into ordinary JavaScript objects. Keys such as __proto__, constructor, and prototype have historically changed inherited properties in vulnerable merge paths.
The symptom may appear far from parsing: an authorization flag becomes truthy, configuration defaults change, or unrelated objects gain a property after one request.
Locate the transformation boundary
JSON.parse creates data; the risky step is usually a later deep merge, path setter, query parser, or object mapper. Reduce the failure to a synthetic payload and trace each transformation without using an exploit against shared systems.
- Record the exact library and version that performs the merge
- Test own properties separately from inherited properties
- Check nested and encoded forms of blocked property names
- Verify that authorization never trusts merged client defaults
Map input into an explicit schema
Copy allowlisted fields into a fresh domain object and reject unknown keys where the contract permits. A null-prototype dictionary can help for true key-value maps, but it does not replace schema validation or safe merge semantics.
Upgrade affected libraries and add regression fixtures at the public boundary. Do not rely on deleting suspicious keys after an unsafe recursive operation has already run.
A Flashman workflow
Use the JSON formatter with harmless fixtures, diff to compare own and inherited output, case converter to inspect field mapping, and hash tool to label regression samples without retaining sensitive payloads.
Test top-level and nested special keys, arrays, encoded transport forms, unknown properties, defaults, logging, and every endpoint that shares the same merge utility.