Deep merge modifies prototype chain

Code reviewSecuritySenior–Staff~28 min

Review this JavaScript deep-merge used on request bodies (Node.js).

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 28 min

Mark a line and say what kind of problem it is.0 findings

1function deepMerge(target, source) {

2 for (const key in source) {

3 if (typeof source[key] === 'object' && source[key] !== null) {

4 if (!target[key]) target[key] = {};

5 deepMerge(target[key], source[key]);

6 } else {

7 target[key] = source[key];

8 }

9 }

10 return target;

11}

13app.patch('/settings', (req, res) => {

14 const settings = deepMerge(loadDefaults(), req.body);

15 saveSettings(req.user.id, settings);

16 res.json(settings);

17});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.