Prototype Pollution in Actix with Basic Auth

Prototype Pollution occurs when an attacker can modify the prototype of JavaScript objects, typically in environments that parse and merge user-supplied JSON into shared object prototypes. In Actix-based applications that accept JSON payloads and perform runtime merging—such as configuration objects or request DTOs—prototype pollution can arise when incoming objects contain special keys like __proto__, constructor.prototype, or prototype. These keys can mutate shared prototypes, affecting behavior across requests in long-running processes.

When Basic Authentication is used in Actix, the framework commonly parses credentials early in the request lifecycle, often before authorization checks. If the application merges user-controlled JSON (e.g., preferences, filters, or dynamic configuration) with server-side objects after authentication, the polluted prototype can influence how authorization logic behaves. For example, a merged object might inadvertently override equality checks, default values, or permission flags used after Basic Auth validation. Because Actix services often deserialize payloads into structs or hashmaps, improperly handled merges can allow an attacker to inject properties that affect downstream logic, such as role evaluation or feature flags, without needing to authenticate.

Consider an Actix handler that merges a user-provided JSON patch into a base configuration map after validating Basic Auth credentials. If the merge is shallow and does not sanitize keys like __proto__, the resulting map may carry mutated prototype properties into authorization decisions. This becomes a security issue when the application later uses those properties to gate access to protected endpoints. Unlike authenticated attacks that require valid credentials, prototype pollution in this context can be triggered in unauthenticated attack surface areas scanned by middleBrick, which tests endpoints that accept JSON input without requiring a token. middleBrick’s checks for Input Validation and Unsafe Consumption highlight cases where untrusted data reaches object construction or merging logic, helping identify paths that could lead to prototype pollution in Actix services using Basic Auth.

Remediation focuses on preventing untrusted data from reaching prototype-sensitive operations and ensuring Basic Auth is applied consistently before any mutable merging. Use strict deserialization with type-safe structs and avoid generic map merging for user-controlled input. When merging is necessary, sanitize keys and use crates that do not follow JavaScript-like prototype semantics.

Example 1: Safe Basic Auth extraction with typed DTOs

use actix_web::{web, HttpRequest, HttpResponse, Result};
use serde::Deserialize;

#[derive(Deserialize)]
struct SafeConfig {
    theme: String,
    max_retries: u32,
}

async fn handler(
    req: HttpRequest,
    config: web::Json,
) -> Result {
    // Basic Auth is validated by a guard or extractor before this point
    let credentials = req.headers().get("Authorization")
        .and_then(|v| v.to_str().ok())
        .and_then(|s| s.strip_prefix("Basic "))
        .unwrap_or("");
    // Perform validation of credentials here or rely on an extractor
    if !is_valid_basic_auth(credentials) {
        return Ok(HttpResponse::Unauthorized().finish());
    }
    // Safe: config is a typed struct, no prototype pollution possible
    Ok(HttpResponse::Ok().json(config.into_inner()))
}

fn is_valid_basic_auth(header: &str) -> bool {
    // Implement proper validation, e.g., decode base64 and check credentials
    !header.is_empty()
}

Example 2: Avoiding prototype-vulnerable merges

use actix_web::web;
use serde_json::{json, Map, Value};

fn safe_merge(base: &mut Map, patch: Map) {
    for (key, value) in patch {
        // Reject keys that could affect prototype or object behavior
        if ["__proto__", "constructor", "prototype"].contains(&key.as_str()) {
            continue; // or return an error
        }
        base.insert(key, value);
    }
}

async fn update_config(
    base_data: web::Json>,
    patch: web::Json>,
) -> web::Json> {
    let mut base = base_data.into_inner();
    let patch = patch.into_inner();
    safe_merge(&mut base, patch);
    web::Json(base)
}

Example 3: MiddleBrick integration for continuous detection

Use the middleBrick CLI to scan your Actix endpoints and validate that input validation blocks prototype pollution paths. Run middlebrick scan <url> against your staging API to obtain per-category findings, including Input Validation and Unsafe Consumption. The Pro plan’s continuous monitoring can schedule these scans and alert your team if new risk patterns appear. In CI/CD, the GitHub Action can fail builds when risk scores drop below your chosen threshold, ensuring prototype-prone merges are caught before deployment.