detect-object-injection

Detects variable[key] written as an assignment target, or read and then invoked (prototype pollution, method injection). This rule is part of eslint-plugin-secure-coding and provides LLM-optimized error messages with fix suggestions.

🚨 Security rule | 💡 Provides LLM-optimized guidance | 🔧 Opt-in — not in recommended

Opt-in only. This rule is deliberately absent from recommended, recommended-strict and owasp-top-10. It reports every computed member access it cannot prove safe, so on ordinary application code it fires on obj[key] throughout — a trade worth making deliberately, not one a preset should make for you. It ships in strict, or enable it explicitly:

Copy Text

rules: { 'secure-coding/detect-object-injection': 'error' }

Quick SummaryCopy Anchor Link

Vulnerability and RiskCopy Anchor Link

Vulnerability: Object injection (specifically Prototype Pollution) occurs when user input is used to access or modify properties of an object, particularly using bracket notation (e.g., obj[userInput]) without validation.

Risk: Attackers can modify critical properties like __proto__, constructor, or prototype, affecting the behavior of all objects in the application. This can lead to Denial of Service (DoS), bypass of security checks, or even Remote Code Execution (RCE) depending on how the polluted properties are used.

Rule DetailsCopy Anchor Link

This rule detects dangerous use of bracket notation with dynamic property names that can lead to prototype pollution attacks.

What clears a key — and what never doesCopy Anchor Link

A key is cleared only by evidence about where its value comes from: a const bound to a literal, an import, a for…of over a literal list, an Object.keys / for…in key, a numeric expression, or a guard (Object.hasOwn, an allowlist includes, k in o) on the branch that reaches the write.

A key's spelling never clears it. PATH_METADATA, userStatus and eventType are reported exactly like k when nothing in the file proves their value — a parameter spelled like a constant is still whatever the caller passed:

const PATH_METADATA = 'path';
obj[PATH_METADATA] = value; // ✅ cleared — the declaration is a literal

function set(o, MODE, v) {
  o[MODE] = v; // ❌ reported — MODE is a parameter; its name proves nothing
}

Error Message FormatCopy Anchor Link

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-915 OWASP:A01 CVSS:9.8 | Object Injection detected | CRITICAL [SOC2,PCI-DSS,ISO27001]
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A01_2021/

Message ComponentsCopy Anchor Link

ConfigurationCopy Anchor Link

ExamplesCopy Anchor Link

❌ IncorrectCopy Anchor Link

// Prototype pollution - CRITICAL risk
obj[userInput] = value; // If userInput is "__proto__", pollutes all objects

// Constructor manipulation - HIGH risk
config[userKey] = func; // If userKey is "constructor", injects methods

// Property injection - MEDIUM risk
settings[dynamicKey] = data; // Uncontrolled property addition

✅ CorrectCopy Anchor Link

// Use Map for dynamic key-value storage
const config = new Map<string, any>();
config.set(userKey, value);

// Use Object.create(null) for clean objects
const safeObj = Object.create(null);
safeObj[userKey] = value; // Safe because no prototype

// Property whitelisting
const ALLOWED_KEYS = ['name', 'age', 'email', 'role'];
if (ALLOWED_KEYS.includes(userKey)) {
  obj[userKey] = value;
}

// A plain read cannot pollute a prototype, so it is not reported.
// (Reading an attacker-chosen field is information exposure, CWE-200 —
// a different weakness this rule does not claim.)
const value = obj[userKey];

A read IS reported when its result is invoked — handlers[req.body.action](payload) resolves "constructor" to the Object constructor and calls it (method injection).

Prototype Pollution PreventionCopy Anchor Link

Understanding the AttackCopy Anchor Link

// Attacker controls userInput = "__proto__"
// This pollutes ALL objects in the application
obj[userInput] = { malicious: () => console.log('HACKED') };

// Now ALL objects have the malicious property
const innocent = {};
console.log(innocent.malicious); // Function exists!

Safe AlternativesCopy Anchor Link

1. Map for Key-Value Storage

   Copy Text

   const config = new Map<string, any>();
   config.set(userKey, value);
   const value = config.get(userKey);

2. Object.create(null)

   Copy Text

   const safeObject = Object.create(null); // No prototype
   safeObject[userKey] = value;

3. Property Whitelisting

   Copy Text

   const ALLOWED_PROPS = ['name', 'age', 'email'];
   if (ALLOWED_PROPS.includes(prop)) {
     obj[prop] = value;
   }

Why This MattersCopy Anchor Link

Migration GuideCopy Anchor Link

Phase 1: DiscoveryCopy Anchor Link

{
  rules: {
    'secure-coding/detect-object-injection': 'warn'
  }
}

Phase 2: Replace Dynamic AccessCopy Anchor Link

// Replace object access
obj[key] → use Map or whitelisting

// Replace assignments
obj[key] = value → map.set(key, value)

Phase 3: Add ValidationCopy Anchor Link

// Implement property validation
function isValidProperty(prop: string): boolean {
  const ALLOWED = ['name', 'value', 'type'];
  return ALLOWED.includes(prop) && !prop.startsWith('_');
}

Phase 4: Secure ImplementationCopy Anchor Link

// Use secure patterns
const config = new Map();
const safeObj = Object.create(null);

Advanced ProtectionCopy Anchor Link

Deep Prototype ProtectionCopy Anchor Link

// Freeze prototypes (careful - affects entire application)
Object.freeze(Object.prototype);
Object.freeze(Array.prototype);

// Or use a security library
import { secureObject } from 'security-utils';
const safeObj = secureObject.create();

Type-Safe AccessCopy Anchor Link

// TypeScript: strict property access
interface SafeConfig {
  [key: string]: never; // No index signature
  name: string;
  value: number;
}

const config: SafeConfig = { name: '', value: 0 };
// config[userKey] = value; // TypeScript error!

Testing SecurityCopy Anchor Link

// Test prototype pollution attempts
const pollutionAttempts = [
  '__proto__',
  'prototype',
  'constructor',
  '__defineGetter__',
  '__defineSetter__',
];

for (const prop of pollutionAttempts) {
  expect(() => {
    const obj = {};
    obj[prop] = 'malicious';
    return obj.hasOwnProperty('malicious');
  }).toBe(false); // Should not pollute
}

Comparison with AlternativesCopy Anchor Link

Related RulesCopy Anchor Link

• detect-eval-with-expression - Prevents code injection via eval()
• detect-child-process - Prevents command injection
• detect-non-literal-fs-filename - Prevents path traversal
• no-unsafe-dynamic-require - Prevents unsafe module loading
• detect-non-literal-regexp - Prevents ReDoS attacks

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Property from VariableCopy Anchor Link

Why: Property names stored in variables not traced.

// ❌ NOT DETECTED - Property from variable
const prop = userInput;
obj[prop] = value;

Mitigation: Validate keys before any bracket access.

Nested Object AccessCopy Anchor Link

Why: Deep property chains not fully analyzed.

// ❌ NOT DETECTED - Nested access
obj.nested[userKey] = value;

Mitigation: Apply whitelisting to all levels.

Object.assign with SpreadCopy Anchor Link

Why: Spread of user objects may pollute.

// ❌ NOT DETECTED - Object spread
const result = { ...userObject }; // May contain __proto__

Mitigation: Use safe merge utilities.

JSON.parse PollutionCopy Anchor Link

Why: Parsed JSON can introduce prototype keys.

// ❌ NOT DETECTED - JSON pollution
const obj = JSON.parse(userJson); // May have __proto__

Mitigation: Use JSON.parse with reviver. Filter keys.

Further ReadingCopy Anchor Link

• Prototype Pollution Attacks - Prototype pollution guide
• JavaScript Prototype Security - Prototype chain security
• CWE-915: Object Prototype Modification - Official CWE entry
• ESLint MCP Setup - Enable AI assistant integration

⚙️ OptionsCopy Anchor Link

Use this rule

npm install -D oxlint-plugin-secure-coding

{  "jsPlugins": ["oxlint-plugin-secure-coding"],  "rules": {    "secure-coding/detect-object-injection": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-secure-coding'],    rules: {      'secure-coding/detect-object-injection': 'error',    },  },});