Prototype pollution — `merge`, `assign`, and friends

function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === "object") {
      target[key] = target[key] || {};
      merge(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

merge({}, JSON.parse(userInput));

function stripDangerousKeys(value) {
  if (Array.isArray(value)) return value.map(stripDangerousKeys);
  if (value && typeof value === "object") {
    const out = Object.create(null);
    for (const key of Object.keys(value)) {
      if (key === "__proto__" || key === "constructor" || key === "prototype") {
        continue;
      }
      out[key] = stripDangerousKeys(value[key]);
    }
    return out;
  }
  return value;
}

You are remediating prototype-pollution surface in this
JavaScript / TypeScript repo. Output a PR or a TRIAGE.md.

## Step 0 — Inventory

1. Grep for hand-rolled merge functions: `function merge(`,
   `function extend(`, `function deepMerge(`, recursive
   `for-in` loops that assign into nested objects.
2. Identify every entry-point that parses user input into
   nested objects: `body-parser`, `qs.parse` with
   `allowPrototypes`, form-data parsers, GraphQL resolvers
   that spread untyped variables.
3. Check pinned versions of `lodash`, `deepmerge`, `hoek`,
   `merge-deep`, `defaults-deep`. Anything pinned old is a
   suspect.

## Step 1 — Pick the strategy

- **Hand-rolled merge:** uplift to a vetted library, *and*
  install the boundary filter for defence-in-depth.
- **Old-pinned vetted library:** bump to the patched version,
  install the boundary filter.
- **Boundary parsers without filtering:** install the boundary
  filter.

## Step 2 — Install the boundary filter

1. Add the `stripDangerousKeys` utility (or import a
   maintained equivalent) at a stable module path.
2. Wrap every parsed-from-user-input boundary:
   - Express `body-parser`: replace
     `app.use(express.json())` with a wrapper that filters
     after parse.
   - Form parsers: filter after parse.
   - `JSON.parse(req.body)`: wrap with the filter.
3. Use `Object.create(null)` for any object built from user
   input where the application logic doesn't depend on
   `Object.prototype` methods being inherited.

## Step 3 — Replace hand-rolled merges

For each hand-rolled merge:

1. Identify the closest vetted equivalent
   (`Object.assign`, `lodash.merge`@latest, `deepmerge`,
   `structuredClone`).
2. Replace the hand-rolled function. Delete the old one if
   no callers remain.
3. If the hand-rolled merge had application-specific
   behaviour (e.g., array concatenation rules), encode that
   behaviour in the vetted library's options.

## Step 4 — Tests

Add tests:

- A `__proto__` payload: the merge does not set
  `Object.prototype.<key>`.
- A `constructor.prototype` payload: same assertion.
- A normal nested payload: the merge produces the expected
  object (behaviour preservation).
- After the request returns, `({}).polluted` is `undefined`
  (no leakage to other objects in the runtime).

## Step 5 — Open the PR

- Branch: `remediate/proto-pollution-<module-slug>`.
- Title: `[Security][prototype-pollution] filter dangerous keys at <module>`.
- Body: call-site inventory, library bumps, boundary filter
  installation, tests added.
- Label: `sec-auto-remediation`.

## Stop conditions

- The codebase legitimately uses `__proto__` as a property
  name (rare; if so, document and triage).
- A merge utility's behaviour-preservation test fails on a
  normal payload after the swap. Triage.
- `Object.freeze(Object.prototype)` would break
  load-bearing libraries; defer that mitigation.

## Scope

- Do not bundle unrelated refactors.
- Do not silently broaden the boundary filter to permit
  dangerous keys.
- Do not delete hand-rolled merges that are still called by
  code outside this PR's scope.