00:00

#0503

Query String Parser

Medium+100 XPA08:2021 Software and Data Integrity FailuresCWE-1321
Prototype PollutionQuery Parsing

Scenario

Your API parses bracket-notation query strings — e.g. `user[name]=alice` — into nested objects.

The parser splits each key by `[` and `]` without validating individual segments, so an attacker can send `__proto__[isAdmin]=true` and pollute Object.prototype before any business logic runs.

Query string parsers are among the most common entry points for prototype pollution because user input is split into object keys automatically. Libraries like qs and querystring have shipped real CVEs for exactly this pattern.

Your Tasks

  1. After splitting a key into its bracket segments, validate each segment.
  2. Throw `'Prototype pollution detected'` if any segment equals `__proto__`, `constructor`, or `prototype`.
  3. Return the correctly parsed object for safe query strings.

Examples

Example 1Exploit — prototype chain injection via query string

parseQueryString('__proto__[isAdmin]=true')
// throws: 'Prototype pollution detected'

Example 2Safe — bracket notation parsed correctly

parseQueryString('user[name]=alice&user[role]=viewer')
// returns: {user: {name: 'alice', role: 'viewer'}}

Constraints

  • Throw exactly `'Prototype pollution detected'` on any forbidden segment.
  • Support both flat keys (`id=123`) and bracket-notation keys (`user[name]=alice`).
  • An empty query string must return an empty object without throwing.

Hint

References

solution.js
Ln 1, Col 1UTF-8JavaScript
Sandbox ready
0/0/0not run