1
    let key = keys[j] === '' ? (currentParams as any).length : keys[j];
    if (key === '__proto__') {
      throw new Error('Prototype pollution detected.');
    }

It at least defeats basic url-encoding, but I am unsure if it is robust enough to stop all avenues of attack.

0

You must log in to answer this question.

Browse other questions tagged .