VBC-947: prototype-pollution-risk

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security ai-error

What it reports

Merging untrusted request body directly at line {line}. This pattern enables prototype pollution: an attacker can inject proto or constructor.prototype to corrupt the application object model. Validate and whitelist all accepted fields before merging user-supplied objects.

Flagged

Object.assign({}, req.body);

Not flagged

Object.assign({}, defaults, options);

Pattern

Object\.assign\s*\(\s*(?:req\.body|request\.body|params|query|body)\s*\)|_\.merge\s*\(\s*(?:req\.body|request\.body|params)\s*\)|Object\.assign\s*\(\s*\{\s*\}\s*,\s*(?:req\.body|request\.body)