2. Tutorials
  3. Node.js — Securely Parse JSON

Node.js — Securely Parse JSON

Node.js provides a global JSON object providing methods to parse a JSON string to JavaScript or stringify JavaScript values to a JSON string.

The problem is that JavaScript’s global JSON object comes with a flaw allowing prototype pollution attacks. This tutorials shows you how to securely parse JSON with prototype pollution protection.

Node.js Series Overview

  1. Increase the Memory Limit for Your Process
  2. Why You Should Add “node” in Your Travis Config
  3. Create a PDF from HTML with Puppeteer and Handlebars
  4. Create Your Own Custom Error
  5. Retrieve a Request’s IP Address in Node.js
  6. Detect the Node.js Version in a Running Process or App
  7. How to Base64 Encode/Decode a Value in Node.js
  8. Check if a Value Is Null or Undefined in JavaScript or Node.js
  9. How to Fix “Uncaught SyntaxError: Cannot use import statement outside a module”
  10. Fix „Socket Hang Up“ Errors
  11. Nested Destructuring in JavaScript or Node.js
  12. Cache Computation Results in a Local Variable
  13. ESM Bypass Cache for Dynamic Imports
  14. How to Fix ESM Error “Directory import is not supported resolving ES modules imported”
  1. String Replace All Appearances
  2. Remove All Whitespace From a String in JavaScript
  3. Generate a Random ID or String in Node.js or JavaScript
  4. Remove Extra Spaces From a String in JavaScript or Node.js
  5. Remove Numbers From a String in JavaScript or Node.js
  6. Get the Part Before a Character in a String in JavaScript or Node.js
  7. Get the Part After a Character in a String in JavaScript or Node.js
  8. How to Check if a Value is a String in JavaScript or Node.js
  9. Check If a String Includes All Strings in JavaScript/Node.js/TypeScript
  10. Check if a Value is a String in JavaScript and Node.js
  11. Limit and Truncate a String to a Given Length in JavaScript and Node.js
  12. Split a String into a List of Characters in JavaScript and Node.js
  13. How to Generage a UUID in Node.js
  14. Reverse a String in JavaScript or Node.js
  15. Split a String into a List of Lines in JavaScript or Node.js
  16. Split a String into a List of Words in JavaScript or Node.js
  17. Detect if a String is in camelCase Format in Javascript or Node.js
  18. Check If a String Is in Lowercase in JavaScript or Node.js
  19. Check If a String is in Uppercase in JavaScript or Node.js
  20. Get the Part After First Occurrence in a String in JavaScript or Node.js
  21. Get the Part Before First Occurrence in a String in JavaScript or Node.js
  22. Get the Part Before Last Occurrence in a String in JavaScript or Node.js
  23. Get the Part After Last Occurrence in a String in JavaScript or Node.js
  24. How to Count Words in a File
  25. How to Shuffle the Characters of a String in JavaScript or Node.js
  26. Append Characters or Words to a String in JavaScript or Node.js
  27. Check if a String is Empty in JavaScript or Node.js
  28. Ensure a String Ends with a Given Character in JavaScript or Node.js
  29. Left-Trim Characters Off a String in JavaScript or Node.js
  30. Right-Trim Characters Off a String in JavaScript or Node.js
  31. Lowercase the First Character of a String in JavaScript or Node.js
  32. Uppercase the First Character of a String in JavaScript or Node.js
  33. Prepend Characters or Words to a String in JavaScript or Node.js
  34. Check if a String is a Number
  35. Convert a String to Buffer
  36. Prevent Line Breaks in String Template Literals
  37. How to Implement a Custom `toString` Method (Coming soon)
  38. What Is `Symbol.toStringTag` and How to Use It (Coming soon)
  1. Filter Data in Streams
  1. Get Number of Seconds Since Epoch in JavaScript
  2. Get Tomorrow’s Date in JavaScript
  3. Increase a Date in JavaScript by One Week
  4. Add Seconds to a Date in Node.js and JavaScript
  5. Add Month(s) to a Date in JavaScript or Node.js
  6. Add Week(s) to a Date in JavaScript or Node.js
  7. Get the Current Year in JavaScript or Node.js
  8. How to Get a UNIX Timestamp in JavaScript or Node.js
  9. How to Convert a UNIX Timestamp to a Date in JavaScript or Node.js
  10. Add Days to a Date in JavaScript or Node.js
  11. Get Yesterday's Date in JavaScript or Node.js
  12. Add Minutes to a Date in JavaScript or Node.js
  13. Add Hours to a Date in JavaScript or Node.js
  14. Check If a Date Is Today in JavaScript or Node.js
  15. Check If a Date is Tomorrow in JavaScript or Node.js
  16. Check If a Date is Yesterday in JavaScript or Node.js
  17. How to Format a Date YYYY-MM-DD in JavaScript or Node.js
  18. Convert a Date to UTC in JavaScript or Node.js (Coming soon)
  19. Get Number of Days in a Month (Coming soon)
  1. How to Run an Asynchronous Function in Array.map()
  2. How to Reset and Empty an Array
  3. for…of vs. for…in Loops
  4. Clone/Copy an Array in JavaScript and Node.js
  5. Get an Array With Unique Values (Delete Duplicates)
  6. Sort an Array of Integers in JavaScript and Node.js
  7. Sort a Boolean Array in JavaScript, TypeScript, or Node.js
  8. Check If an Array Contains a Given Value in JavaScript or Node.js
  9. Add an Item to the Beginning of an Array in JavaScript or Node.js
  10. Append an Item at the End of an Array in JavaScript or Node.js
  11. How to Exit and Stop a for Loop in JavaScript and Node.js
  12. Split an Array Into Smaller Array Chunks in JavaScript and Node.js
  13. How to Get an Index in a for…of Loop in JavaScript and Node.js
  14. How to Exit, Stop, or Break an Array#forEach Loop in JavaScript or Node.js
  15. Retrieve a Random Item From an Array in JavaScript or Node.js
  16. How to Reverse an Array in JavaScript and Node.js
  17. Sort an Array of Strings in JavaScript, TypeScript or Node.js
  18. Sort an Array of Objects in JavaScript, TypeScript or Node.js
  19. Check If a Value Is an Array in JavaScript or Node.js
  20. Join an Array of Strings to a Single String Value
  21. Create and Fill an Array Containing N Items
  1. Callback and Promise Support in your Node.js Modules
  2. Run Async Functions/Promises in Sequence
  3. Run Async Functions/Promises in Parallel
  4. Run Async Functions in Batches
  5. How to Fix “Promise resolver undefined is not a function” in Node.js or JavaScript
  6. Detect if Value Is a Promise in Node.js and JavaScript
  7. Overview of Promise-Based APIs in Node.js
  8. Thenables and Creating Your Own Promises
  1. Check If a Value Is Iterable in JavaScript or Node.js
  2. Check If a Value Is Async Iterable in JavaScript or Node.js
  3. What is `Symbol.iterator`?
  4. How to Implement an Iterator
  1. Extend Multiple Classes (Multi Inheritance)
  2. Retrieve the Class Name at Runtime in JavaScript and Node.js
  3. Deprecate a Method in JavaScript and TypeScript
  1. Generate a Random Number in Range With JavaScript/Node.js
  2. Ensure a Positive Number in JavaScript or Node.js
  3. Check if a Number Is Infinity
  4. Check If a Number has Decimal Places in JavaScript or Node.js
  5. Use Numeric Separators for Better Readability
  6. Convert Boolean to Number
  7. Convert Number to Boolean
  8. Check if a Value is a Number
  1. How to Merge Objects
  2. How to Check if an Object is Empty in JavaScript or Node.js
  3. How to CamelCase Keys of an Object in JavaScript or Node.js
  4. How to Snake_Case Keys of an Object in JavaScript or Node.js
  5. How to Destructure a Dynamic Key in JavaScript or Node.js
  6. How to Get All Keys (Including Symbols) from an Object in JavaScript or Node.js
  7. How to Delete a Key From an Object in JavaScript or Node.js
  8. Iterate Through an Object’s Keys and Values in JavaScript or Node.js
  9. How to Convert URLSearchParams to Object
  10. Check If a Value Is an Object in JavaScript or Node.js
  11. Conditionally Add Properties to an Object in JavaScript or Node.js
  12. How to Lowercase Keys of an Object in JavaScript or Node.js
  13. Unset an Object Property
  1. Get a File’s Created Date
  2. Get a File’s Last Modified or Updated Date of a File
  3. How to Create an Empty File
  4. Check If a Path or File Exists
  5. How to Rename a File
  6. Check If a Path Is a Directory
  7. Check If a Path Is a File
  8. Retrieve the Path to the User’s Home Directory
  9. How to Touch a File
  10. Read File Content as String
  11. Check If a Directory Is Empty
  12. How to Create a Directory (and Parents If Needed)
  13. Get a File‘s Extension
  14. Get the Size of a File
  15. Get a File Name (With or Without Extension)
  16. Read a JSON File
  17. Delete a File From Disk
  18. Check if a Path is a SymLink (Symbolic Link)
  19. Check if a Path is a Socket
  20. Check if a Path is a FIFO File (Named Pipe)
  21. Check if a Path is a File URL
  22. Handling `fs.Stats` Constructor is Deprecated
  23. What is `Fs.realpath`?
  1. Create From Object
  2. Transform to an Object
  1. Determine the Node.js Version Running Your Script
  2. Show Your NODE_MODULE_VERSION
  1. Check if a Value is a Symbol in JavaScript or Node.js
  1. Detect if Running on Linux
  2. Detect if Running on macOS
  3. Detect if Running on Windows
  4. Check if Running on 64bit or 32bit Platform
  5. Constant for Platform-Specific Newline
  6. Determine the Current Operating System
  7. Retrieve the OS Directory for Temporary Files
  1. How to Download a File
  2. Strict Type for Request Headers with TypeScript
  1. Calculate an MD5 Hash
  2. Retrieve the List of Supported Hash Algorithms
  3. Calculate a SHA256 Hash
  4. Calculate a SHA512 Hash
  1. Using the Styletext Utility for Terminal Text Formatting

Prototype Pollution in a Nutshell

Consider the following code snippet illustrating the prototype pollution:

const json = '{"name":"Supercharge", "__proto__": { "x": 1 }}'

const a = JSON.parse(json)  
// { name: 'Supercharge' }

console.log(a.x)  
// undefined

const b = Object.assign({}, a)  
console.log(b.x)  
// 1

JSON.parse keeps the __proto__ property as a key on the parsed object. This becomes a problem when assigning that object to another object or copying values to another object. Then, the __proto__ property becomes the prototype of the new object.

Secure JSON.parse

That’s why we developed the @supercharge/json package to securely parse JSON strings. The @supercharge/json removes constructor and __proto__ keys when parsing objects.

Using @supercharge/json with the example from above keeps your code secure by removing injected prototype properties:

const JSON = require('@supercharge/json')

const json = '{"name":"Supercharge", "__proto__": { "x": 1 }}'

const a = JSON.parse(json)  
// { name: 'Supercharge' }

console.log(a.x)  
// undefined

const b = Object.assign({}, a)

console.log(b.x)  
// undefined    👈

That’s it!

Mentioned Resources

Marcus Pöhls

Marcus is a fullstack JS developer. He’s passionate about the hapi framework for Node.js and loves to build web apps and APIs. Creator of Futureflix and the “learn hapi” learning path.

Explore the Library

Find interesting tutorials and solutions for your problems.

Android

Node.js

Server

Miscellaneous