A08:2025 Software or Data Integrity Failures

// VULNERABLE://   function merge(target, src) { for (const k in src) {//     target[k] = (typeof src[k] === 'object') ? merge(target[k] || {}, src[k]) : src[k]; } return target; }//   merge(config, JSON.parse('{"__proto__":{"isAdmin":true}}'));   // now ({}).isAdmin === true everywhere// FIXED: deny the three dangerous keys; only recurse into plain objects; use null-prototype targets.const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);function isPlainObject(v) {  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;  const p = Object.getPrototypeOf(v);  return p === Object.prototype || p === null;}function safeMerge(target, src) {  if (!isPlainObject(src)) return target;  for (const key of Object.keys(src)) {                       // own enumerable only    if (FORBIDDEN_KEYS.has(key)) continue;    const val = src[key];    if (isPlainObject(val)) {      if (!isPlainObject(target[key]) || !Object.hasOwn(target, key)) target[key] = Object.create(null);      safeMerge(target[key], val);    } else {      target[key] = val;    }  }  return target;}const evil = JSON.parse('{"__proto__":{"polluted":"yes"},"constructor":{"prototype":{"polluted2":"yes"}},"ok":{"deep":1}}');const cfg = safeMerge(Object.create(null), evil);// JSON.parse reviver variant: drop the keys at parse timefunction safeParse(text) {  return JSON.parse(text, (k, v) => (FORBIDDEN_KEYS.has(k) ? undefined : v));}const parsed = safeParse('{"a":1,"__proto__":{"x":1},"b":{"constructor":{"y":2}}}');// Mitigations also: Object.freeze(Object.prototype) at startup; --disable-proto=delete; Map instead of {} for user keys.

// VULNERABLE://   const obj = eval('(' + req.body.data + ')');                     // RCE//   const fn = new Function('return ' + req.query.expr)();             // RCE//   node-serialize .unserialize(cookie)  // IIFE in payload => RCE (classic CVE)// FIXED: JSON.parse only (data, not code), then validate the shape against a schema.function parseOrder(text) {  const o = safeParse(text);  if (!isPlainObject(o)) throw new TypeError('order must be an object');  if (typeof o.sku !== 'string' || !Number.isInteger(o.qty) || o.qty < 1) throw new TypeError('bad order');  return { sku: o.sku, qty: o.qty };                            // allowlist the fields you copy out}

// VULNERABLE://   charge(req.user, req.body.price * req.body.qty);               // attacker posts price=0.01//   if (req.body.role === 'admin') grantAdmin();// FIXED: server-side source of truth; the client only sends identifiers.const catalog = new Map([['a1', 1999]]);function priceOrder({ sku, qty }) {  const unit = catalog.get(sku);  if (unit === undefined) throw new Error('unknown sku');  return unit * qty;}

// VULNERABLE: cookie `prefs=eyJ1aWQiOjEsInJvbGUiOiJhZG1pbiJ9` (base64 JSON) read back and trusted.// FIXED:const SECRET = crypto.randomBytes(32);function signCookie(obj, key = SECRET) {  const body = Buffer.from(JSON.stringify(obj)).toString('base64url');  return body + '.' + crypto.createHmac('sha256', key).update(body).digest('base64url');}function readCookie(cookie, key = SECRET) {  const dot = cookie.lastIndexOf('.');  if (dot < 0) return null;  const body = cookie.slice(0, dot);  const mac = Buffer.from(cookie.slice(dot + 1));  const want = Buffer.from(crypto.createHmac('sha256', key).update(body).digest('base64url'));  if (mac.length !== want.length || !crypto.timingSafeEqual(mac, want)) return null;  return safeParse(Buffer.from(body, 'base64url').toString('utf8'));}const c = signCookie({ uid: 1, role: 'user' });const forged = Buffer.from(JSON.stringify({ uid: 1, role: 'admin' })).toString('base64url') + '.' + c.split('.')[1];// JWT: same idea — ALWAYS jwt.verify(token, key, { algorithms: ['RS256'] }); jwt.decode() is NOT verification.

// VULNERABLE: <script src="https://cdn.example.com/lib.js"></script>      // CDN compromise => XSS on every page// FIXED:function sriTag(src, bytes) {  const hash = crypto.createHash('sha384').update(bytes).digest('base64');  return `<script src="${src}" integrity="sha384-${hash}" crossorigin="anonymous"></script>`;}const tag = sriTag('https://cdn.example.com/lib.js', Buffer.from('console.log(1)'));// Browser recomputes the hash of the fetched bytes; mismatch => script refused.

//   Auto-update: fetch over TLS, verify detached signature (minisign/Sigstore cosign) before install.//   CI: protected branches, required reviews, pipeline-as-code reviewed, no secrets exposed to fork PRs,//       artifacts hashed + attested (SLSA provenance), deploy only artifacts built by CI (no laptop builds).//   Webhooks: verify X-Hub-Signature-256 (HMAC of raw body) with timingSafeEqual before parsing.