FIX (H6): Strip prototype-pollution keys from a freshly parsed JSON value.
Recursively removes own properties named __proto__, constructor, and
prototype from plain objects. Use immediately after any raw JSON.parse
that does not go through safeJSONParse (streaming parsers, legacy
helpers) so that untrusted payloads can never smuggle pollution keys into
downstream spread/merge operations.
FIX (H6): Strip prototype-pollution keys from a freshly parsed JSON value.
Recursively removes own properties named
__proto__,constructor, andprototypefrom plain objects. Use immediately after any rawJSON.parsethat does not go through safeJSONParse (streaming parsers, legacy helpers) so that untrusted payloads can never smuggle pollution keys into downstream spread/merge operations.