2026-09-01 · 8 min read
- json
- security
- api-design
JSON syntax describes strings, numbers, booleans, null, arrays, and objects. It does not grant incoming object keys permission to become application configuration or domain state. Risk appears when code feeds parsed values into recursive merge, path-assignment, or object-mapping behavior that treats special property names as instructions.
Prototype pollution can alter inherited JavaScript properties and influence objects created later. Even without that specific bug class, mass assignment can let a client set fields such as role, owner, status, or internal feature flags that the endpoint never intended to expose.
Model the input contract explicitly
Validate the complete incoming shape at the trust boundary and construct a fresh domain command from allowlisted fields. Decide whether unknown keys are rejected or ignored, and make nested schemas as explicit as top-level schemas.
- Separate writable input types from stored and response types.
- Apply length, count, depth, and numeric-range limits.
- Reject dangerous path segments in any API that accepts property paths.
- Keep authorization decisions outside client-controlled defaults.
Choose safe data structures and merge semantics
Avoid recursively merging untrusted objects into configuration, class instances, or objects with meaningful prototypes. For a genuine arbitrary-key dictionary, consider Map or a null-prototype object while still validating keys and values.
If partial updates are required, define replacement, omission, and deletion behavior in the API contract. Use a maintained implementation designed for that format rather than a generic deep-merge helper with surprising array or prototype behavior.
Protect every downstream boundary
Database update builders, template contexts, log metadata, and feature-flag evaluation can recreate mass-assignment risk after initial validation. Pass the smallest typed object required by each operation and enforce field-level authorization where ownership matters.
- Do not spread request bodies directly into database updates.
- Do not serialize inherited properties into responses or logs.
- Patch vulnerable parsing and merge dependencies promptly.
- Return bounded errors that do not echo confidential input.
Build a safe verification workflow
Use Flashman's JSON formatter with synthetic objects, diff tool to compare accepted output, case converter to audit naming transformations, hash tool to label fixtures, and URL tool to inspect encoded property-path inputs. Keep production payloads out of shared diagnostics.
Test top-level and nested special names, constructor-shaped objects, arrays, duplicate transport parameters, encoded keys, unknown fields, immutable fields, defaults, logs, database updates, and all endpoints that reuse the same mapper.