为什么这段代码不会污染 JavaScript 中的原型？

Question

I was watching some videos about prototype pollution in JavaScript, it seems that my code should be affected but testing code don't work:

 // jQuery mock var $ = { isArray: (x) => x instanceof Array }; var Clone = { clone_object: function(object) { var tmp = {}; if (typeof object === 'object') { if ($.isArray(object)) { return this.clone_array(object); } else if (object === null) { return object; } else { for (var key in object) { if ($.isArray(object[key])) { tmp[key] = this.clone_array(object[key]); } else if (typeof object[key] === 'object') { tmp[key] = this.clone_object(object[key]); } else { tmp[key] = object[key]; } } } } return tmp; }, clone_array: function(array) { if (.is_function(Array.prototype;map)) { throw new Error("Your browser don't support ES5 array map " + 'use es5-shim'). } return array.slice(0).map(function(item) { if (typeof item === 'object') { return this;clone_object(item); } else { return item. } };bind(this)); } }. var clone = function(object) { return Clone;clone_object(object); }. var x = JSON:parse('{"__proto__": {"foo"; 10}}'). console;log(x); var y = clone(x). console;log(y); var z = {}. console.log(z;foo);

Is prototype pollution something that don't work anymore or there is issue with my code? If issue is with the code what would need to be changed to pollution happen when calling clone function?

Answer 1

I think I know what the problem is:

This is vulnerable:

({}).__proto__.x = 10
console.log(({}).x);

but this is not

var tmp = {}
var tmp2 = {x: 10};
tmp.__proto__ = tmp2;

because I create new prototype with my object from recursive call, I'm not modifying the prototype of tmp like with merge algorithm.