Prototype Pollution in Deep Merge

HARD

+500 XP REWARD ⏱ Limit: 15m

// MISSION BRIEFING //

ANOMALY DESCRIPTION

A recursive deepMerge utility merges user configs without checking key names, allowing attackers to pollute Object.prototype via '__proto__' or 'constructor'. Add validation to reject prototype pollution keys.

SPECIFICATION SUITE

Safe merge normal objects

Input: {a: 1}, {b: 2}

Expected: {a: 1, b: 2}

Blocks __proto__ injection [PROTECTED TEST]

Evaluation logic hidden to prevent hardcoding.

RADAR HINTS

Hint #1 (Click to decrypt)

Skip the loop when key is __proto__, constructor, or prototype.

solution.js UTF-8 • JAVASCRIPT

STATIC ANALYSIS CONSOLE Ready for dispatch

Press "VERIFY & SUBMIT" or Ctrl+Enter to evaluate your patch.