Deep merge allows prototype pollution

Code reviewSecuritySenior–Staff~30 min

Review this JS deep-merge used to apply user-supplied config over defaults.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 30 min

Mark a line and say what kind of problem it is.0 findings

1function deepMerge(target, source) {

2 for (const key in source) {

3 if (typeof source[key] === 'object' && source[key] !== null) {

4 target[key] = target[key] || {};

5 deepMerge(target[key], source[key]);

6 } else {

7 target[key] = source[key];

8 }

9 }

10 return target;

11}

12// usage: deepMerge(defaults, JSON.parse(req.body.config))

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.