Safe object merging; freezing & sealing

Why safe merging?

Shallow merge (spread)

// Shallow merge with spread keeps sources unchanged
const a = { x: 1, y: 2 };
const b = { y: 9, z: 3 };

// Later keys win on conflicts
const merged1 = { ...a, ...b };

console.log("a:", a);
console.log("b:", b);
console.log("merged1:", merged1);

Avoid prototype pollution

// Avoid prototype pollution: use a null-prototype target and skip special keys
function safeMergeUntrusted(pairs) {
  // target has no prototype
  const out = Object.create(null);

  // keys to skip
  const BLOCK = new Set(["__proto__", "prototype", "constructor"]);

  for (const [k, v] of pairs) {
    if (typeof k !== "string") continue;
    if (BLOCK.has(k)) continue;
    out[k] = v;
  }
  return out;
}

const inputPairs = [
  ["name", "Ayla"],
  ["__proto__", { hacked: true }],
  ["role", "user"]
];

const safe = safeMergeUntrusted(inputPairs);

console.log("safe.name:", safe.name);
console.log("safe.role:", safe.role);
console.log("safe.__proto__ is undefined?", safe.__proto__ === undefined);

Clone + assign

// Object.assign can also create a new object
const base = { a: 1, b: 2 };
const patch = { b: 5 };

// New object as first arg → sources untouched
const merged2 = Object.assign({}, base, patch);

console.log("base:", base);
console.log("patch:", patch);
console.log("merged2:", merged2);

Freeze vs seal

// Freeze: no add/remove/change
const frozen = Object.freeze({ id: 1, tag: "locked" });
// Seal: no add/remove, but you may change existing values
const sealed = Object.seal({ id: 2, tag: "open" });

// Attempts (silently fail in non-strict mode)
frozen.tag = "new";
sealed.tag = "updated";
sealed.newKey = 123;

console.log("frozen:", frozen);
console.log("sealed:", sealed);

Safe merge habits

Prototype pollution basics quiz

Recap