gistfile1.txt

// Helper: create a null-prototype object with fields

function obj(data) {

  return Object.assign(Object.create(null), data)

}

// Safe deep merge that prevents prototype pollution

function deepMergeSafe(target, source) {

  if (!isPlainObject(target) || !isPlainObject(source)) return target

  for (const key of Object.keys(source)) {

    if (DANGEROUS_KEYS.has(key)) {

      continue

    }

    const val = source[key]

    if (isPlainObject(val)) {

      if (!Object.prototype.hasOwnProperty.call(target, key) || !isPlainObject(target[key])) {

        target[key] = Object.create(null)

      }

      deepMergeSafe(target[key], val)

    } else {

      target[key] = val

    }

  }

  return target

}

// Create users with null prototypes

app.use((req, res, next) => {

  req.user = obj({

    isAdmin: false,

    username: ‘guest’

  })

  next()

})

// Require own property check for authorization

function isAdmin(user) {

  return Object.hasOwnProperty.call(user, ‘isAdmin’) && user.isAdmin === true

}