Prototype pollution

02Lookup is not ownership

In the fresh worked table, the item owns size and inherits weight. A lookup can return both values even though they have different owners. The provided original object page uses name and color as a separate evidence table. You can classify a property by its stated location without executing that page.

Constrain merge keys to the fields the application expects and reject paths that select prototypes or constructors. For permission-sensitive decisions, avoid trusting inherited defaults and use suitable own-property checks such as Object.hasOwn. These measures fit different parts of the flow; an own-property check alone cannot repair every unsafe merge.

03Apply the allowlist

Read the evidence before comparing with the activity rubric. Do not open the HTML file in a browser for the checkpoint.

Object table. Not executed.

item own keys: name
item inherited keys: color
lookup name: lamp
lookup color: red

Use the stated key lists to classify ownership. A lookup does not move a key between those lists.

Merge rule: copy a key only when the key is on the allowlist name and title.
Do not copy a key that selects the shared prototype or the constructor.

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Own and inherited</title>
</head>
<body>
  <script>
    var base = { color: "red" };
    var item = Object.create(base);
    item.name = "lamp";
  </script>
</body>
</html>

1. Write the own key and the inherited key from the table.
2. Write the keys the merge rule is allowed to copy.
3. Check: the merge copies name and title only. color stays on the list the table already gave it. You do not need to run the page.
4. Stop. Do not add an assignment that selects the shared prototype.

04Optional challenge

Allow about ten minutes. Suppose an object owns enabled=false while its prototype has enabled=true. Predict the ordinary lookup and explain why checking ownership is a different question from reading the value. Rubric: the nearer own property supplies false, and an own-property check confirms where it is stored.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

const base = { color: "violet" };
const item = Object.create(base);
item.name = "moss";
No other keys are defined. Ordinary lookup checks an own property before the prototype.
A read does not move a property to the reading object.

Start from case A, then perform this source-model change:
item.color = "gold";
The statement writes only item’s own color. No prototype write occurs.

Allowed copied fields: name and title only.
Submitted keys: name, title, color, a path selecting the prototype, a path selecting a constructor.
Rule: copy only allowlisted fields; reject prototype/constructor paths. No merge executes.

06Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: derive own and inherited properties from the source; predict own shadowing without changing the prototype; apply the exact key allowlist; distinguish normal inheritance from an unauthorized prototype write.