{"version":"2.1.234","anchor":"string-sanitizer-builds-prototype-free-objects","canonical_anchor":"string-sanitizer-builds-prototype-free-objects","heading":"String sanitizer builds prototype-free objects","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/string-sanitizer-builds-prototype-free-objects","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### String sanitizer builds prototype-free objects\n\nA key named __proto__ in input can no longer tamper with the sanitized result.\n\n**What**\n\nThe recursive sanitizer now creates its result with `Object.create(null)` and takes the per-string transform as an argument, so an input key like `__proto__` cannot alter the object it produces.\n\n**Evidence**\n\n`Object.create(null)`\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 1\/5"}