{"record":{"id":"150132ea5a1149e5","repo":"sveltejs/kit","slug":"invalid-key-key-this-key-is-not-allowed-to-p","errorCode":null,"errorMessage":"Invalid key \"${key}\": This key is not allowed to prevent prototype pollution.","messagePattern":"Invalid key \"(.+?)\": This key is not allowed to prevent prototype pollution\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/kit/src/runtime/form-utils.js","lineNumber":495,"sourceCode":"\tif (!path_regex.test(path)) {\n\t\tthrow new Error(\n\t\t\t`Invalid field name ${path}` +\n\t\t\t\t(DEV\n\t\t\t\t\t? ': field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields'\n\t\t\t\t\t: '')\n\t\t);\n\t}\n\n\treturn path.split(/\\.|\\[|\\]/).filter(Boolean);\n}\n\n/**\n * Check if a property key is dangerous and could lead to prototype pollution\n * @param {string} key\n */\nfunction check_prototype_pollution(key) {\n\tif (key === '__proto__' || key === 'constructor' || key === 'prototype') {\n\t\tthrow new Error(\n\t\t\t`Invalid key \"${key}\"` +\n\t\t\t\t(DEV ? ': This key is not allowed to prevent prototype pollution.' : '')\n\t\t);\n\t}\n}\n\n/**\n * Sets a value in a nested object using an array of keys, mutating the original object.\n * @param {Record<string, any>} object\n * @param {string[]} keys\n * @param {any} value\n */\nexport function deep_set(object, keys, value) {\n\tlet current = object;\n\n\tfor (let i = 0; i < keys.length - 1; i += 1) {\n\t\tconst key = keys[i];\n","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/form-utils.js#L477-L513","documentation":"Form field paths are set into a nested object; keys named __proto__, constructor, or prototype could pollute Object.prototype. check_prototype_pollution rejects these keys outright to keep untrusted form input from corrupting object prototypes.","triggerScenarios":"A form posts a field named __proto__.x, constructor, or prototype[...]; an attacker crafts field names to reach deep_set with dangerous segments.","commonSituations":"Malicious or fuzzed submissions targeting the form parser; echoing user-controlled field names back into the form; generic template forms that accept arbitrary key names.","solutions":["Remove or rename the offending field — never accept __proto__/constructor/prototype as field names.","Validate/allowlist field names on the server before processing the submission.","If the key is legitimately needed, store it under a safe name (e.g. data.constructorName) and document the mapping."],"exampleFix":"// before\nfields.as('__proto__');\n// after\nfields.as('proto_override');","handlingStrategy":"validation","validationCode":"const DANGEROUS = new Set(['__proto__', 'constructor', 'prototype']);\nif (name.split(/[.\\[\\]]/).some((seg) => DANGEROUS.has(seg))) {\n  throw new Error(`field name contains forbidden key: ${name}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Allowlist accepted field names server-side.","Never echo raw, user-controlled names back into form field names.","Treat occurrences of these keys in submissions as suspicious input."],"tags":["security","prototype-pollution","forms"],"backgroundTag":"prototype-pollution","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}