Modifying the JavaScript Object Prototype: Guide

// Adding to Object.prototype — available everywhere
Object.prototype.greet = function() {
  return "Hello from every object!";
};
 
const obj = {};
console.log(obj.greet()); // "Hello from every object!"
 
const arr = [];
console.log(arr.greet()); // "Hello from every object!"
 
const fn = function() {};
console.log(fn.greet()); // "Hello from every object!"

Object.prototype.inspect = function() { return "inspecting"; };
 
const user = { name: "Alice", age: 30 };
 
for (const key in user) {
  console.log(key);
}
// "name"
// "age"
// "inspect"  ← Unexpected! From Object.prototype

// DANGEROUS: user-controlled key modifying prototype
function merge(target, source) {
  for (const key of Object.keys(source)) {
    target[key] = source[key]; // If key is "__proto__", this is dangerous
  }
}
 
const maliciousInput = JSON.parse('{"__proto__": {"admin": true}}');
merge({}, maliciousInput);
 
console.log({}.admin); // true — global prototype pollution!

// Polyfill pattern — only add if not already present
if (!Array.prototype.at) {
  Object.defineProperty(Array.prototype, "at", {
    value: function(index) {
      const n = Math.trunc(index) || 0;
      return n < 0 ? this[this.length + n] : this[n];
    },
    writable: true,
    enumerable: false, // ← Critical: non-enumerable to avoid for...in pollution
    configurable: true,
  });
}

// Instead of: "hello world".truncate(5)
// Write:
function truncate(str, length) {
  return str.length > length ? str.slice(0, length) + "..." : str;
}
 
truncate("hello world", 5); // "hello..."

class EnhancedString {
  constructor(str) {
    this._str = str;
  }
  truncate(length) {
    return this._str.length > length
      ? this._str.slice(0, length) + "..."
      : this._str;
  }
  capitalize() {
    return this._str.charAt(0).toUpperCase() + this._str.slice(1);
  }
  toString() { return this._str; }
}
 
const s = new EnhancedString("hello world");
console.log(s.truncate(5)); // "hello..."
console.log(s.capitalize()); // "Hello world"

const TRUNCATE = Symbol("truncate");
 
Object.defineProperty(String.prototype, TRUNCATE, {
  value: function(length) {
    return this.length > length ? this.slice(0, length) + "..." : String(this);
  },
  enumerable: false,
  writable: true,
  configurable: true,
});
 
const msg = "Hello, world!";
console.log(msg[TRUNCATE](5)); // "Hello..."
// Symbols are invisible to for...in and JSON.stringify
// And cannot be accidentally overwritten by another library using the same string

// WRONG: Direct assignment pollutes for...in
Array.prototype.sum = function() {
  return this.reduce((a, b) => a + b, 0);
};
// [1,2,3] for-in would include "sum"
 
// RIGHT: Non-enumerable, matches native method behavior
Object.defineProperty(Array.prototype, "sum", {
  value: function() { return this.reduce((a, b) => a + b, 0); },
  writable: true,
  enumerable: false,
  configurable: true,
});

// Safe merge function
function safeMerge(target, source) {
  for (const key of Object.keys(source)) {
    // Block dangerous keys
    if (key === "__proto__" || key === "constructor" || key === "prototype") {
      continue;
    }
    if (
      typeof source[key] === "object" &&
      source[key] !== null &&
      typeof target[key] === "object"
    ) {
      safeMerge(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}
 
// Or use Object.create(null) for truly safe key-value stores:
const safeStore = Object.create(null); // No [[Prototype]] — immune to pollution
safeStore["__proto__"] = "safe"; // Just a string key, no prototype effect