# Prototype Pollution (Client-Side)

/**
 * Secure object merge utility
 * Prevents prototype pollution
 */

const DANGEROUS_KEYS = new Set(['__proto__', 'prototype', 'constructor']);

/**
 * Safely merge source into target
 */
function secureMerge(target, source, options = {}) {
    const { deep = false, allowedKeys = null } = options;

    if (!isObject(target) || !isObject(source)) {
        return target;
    }

    for (let key in source) {
        // Skip if not own property
        if (!source.hasOwnProperty(key)) continue;

        // Block dangerous keys
        if (DANGEROUS_KEYS.has(key)) {
            console.warn(`Blocked dangerous key: ${key}`);
            continue;
        }

        // Check against allowed keys whitelist
        if (allowedKeys && !allowedKeys.includes(key)) {
            console.warn(`Key not in whitelist: ${key}`);
            continue;
        }

        const sourceValue = source[key];

        // Deep merge if enabled and both values are objects
        if (deep && isObject(target[key]) && isObject(sourceValue)) {
            target[key] = secureMerge(target[key], sourceValue, options);
        } else {
            target[key] = sourceValue;
        }
    }

    return target;
}

/**
 * Check if value is a plain object
 */
function isObject(obj) {
    return obj !== null && typeof obj === 'object' && !Array.isArray(obj);
}

/**
 * Create safe object without prototype
 */
function createSafeObject(data = {}) {
    const obj = Object.create(null);
    return secureMerge(obj, data);
}

/**
 * Safely parse JSON
 */
function safeJSONParse(json) {
    const parsed = JSON.parse(json);
    return removeDangerousKeys(parsed);
}

/**
 * Recursively remove dangerous keys
 */
function removeDangerousKeys(obj) {
    if (!isObject(obj)) return obj;

    for (let key of DANGEROUS_KEYS) {
        delete obj[key];
    }

    for (let key in obj) {
        if (obj.hasOwnProperty(key) && isObject(obj[key])) {
            obj[key] = removeDangerousKeys(obj[key]);
        }
    }

    return obj;
}

module.exports = {
    secureMerge,
    createSafeObject,
    safeJSONParse,
    removeDangerousKeys
};

/**
 * Express middleware to prevent prototype pollution
 */

const { removeDangerousKeys } = require('./secure-merge');

function prototypePollutionProtection(req, res, next) {
    // Clean request body
    if (req.body) {
        req.body = removeDangerousKeys(req.body);
    }

    // Clean query parameters
    if (req.query) {
        req.query = removeDangerousKeys(req.query);
    }

    // Clean URL parameters
    if (req.params) {
        req.params = removeDangerousKeys(req.params);
    }

    next();
}

module.exports = prototypePollutionProtection;

// Usage in Express app
const express = require('express');
const app = express();

app.use(express.json());
app.use(prototypePollutionProtection);  // Apply middleware

app.post('/api/data', (req, res) => {
    // req.body is now safe from prototype pollution
    console.log(req.body);
    res.json({ success: true });
});

/**
 * Secure configuration management
 */

class SecureConfig {
    constructor(defaults = {}) {
        // Use Map instead of object
        this.config = new Map();

        // Load defaults safely
        this.loadDefaults(defaults);

        // Freeze prototype
        Object.freeze(Object.prototype);
    }

    loadDefaults(defaults) {
        for (let key in defaults) {
            if (defaults.hasOwnProperty(key)) {
                this.set(key, defaults[key]);
            }
        }
    }

    set(key, value) {
        // Validate key
        if (typeof key !== 'string') {
            throw new Error('Key must be string');
        }

        // Block dangerous keys
        if (['__proto__', 'prototype', 'constructor'].includes(key)) {
            throw new Error(`Dangerous key: ${key}`);
        }

        this.config.set(key, value);
    }

    get(key, defaultValue = undefined) {
        return this.config.has(key) ? this.config.get(key) : defaultValue;
    }

    has(key) {
        return this.config.has(key);
    }

    merge(obj) {
        const { secureMerge } = require('./secure-merge');

        const tempObj = {};
        secureMerge(tempObj, obj);

        for (let key in tempObj) {
            this.set(key, tempObj[key]);
        }
    }
}

module.exports = SecureConfig;

// Usage
const config = new SecureConfig({
    apiUrl: 'https://api.example.com',
    timeout: 5000
});

// Safe merge
config.merge({ theme: 'dark' });

// Dangerous keys blocked
try {
    config.set('__proto__', { isAdmin: true });
} catch (e) {
    console.log('Blocked!');
}