feat(scan): --prototype-pollution for Node.js deep-merge authz bypass

[bugsyhewitt]

Summary

Ships one focused improvement: a new --prototype-pollution mutator targeting the canonical Node.js / browser prototype-pollution authz-bypass class (CVE-2018-3721 lodash, CVE-2019-10744 lodash, CVE-2019-11358 jQuery, the 2024 Express qs/parseUrl chains; OWASP Prototype Pollution Prevention cheat sheet).

Pivot note

The R32 task brief proposed --header-injection or --method-override as the next HTTP mutator, with --cache-deception already shipped in R31 and --request-smuggling deferred. Verification against the actual codebase showed that both --header-injection (PR #24) and --method-override (PR #21) have already shipped, along with every other HTTP mutator suggested in POST_V01.md (POST_V01.md was stale — the brief explicitly told me to verify). The shipped set is: swap-object, enumerate-id, mass-assign, xxe, graphql, forbidden-bypass, ws-hijack, csrf-header, method-override, host-header, cookie-tampering, header-injection, parameter-pollution, origin-spoof, content-type-confusion, cache-deception — plus the four deep-JWT mutators and the four classic ones from v0.1.

I pivoted to the next-best unimplemented gap. --prototype-pollution is the strongest remaining mutator-shaped slot:

• High-signal authz-bypass class possession does not currently touch — explicitly distinct from --mass-assign, which sets is_admin at the top level of the model (server-side BOPLA at the object layer); prototype-pollution sets is_admin on Object.prototype (runtime-wide, every object inherits it). Different vuln class, different fix.
• The Node.js ecosystem has been re-discovering this class for 8 years (lodash 2018, jQuery 2019, Express 2024) and the Snyk 2025 advisory landscape ranks it as a dominant access-control bypass vector for the runtime.
• Fits the existing mutator architecture exactly: pure, deterministic, off-by-default, JSON-object body mutator, privesc finding class.
• Disjoint from --mass-assign: the polluted field is buried under the vector key (__proto__, constructor.prototype, or prototype) and the test suite verifies it does NOT leak to the top level. A server that blocks one will not necessarily block the other.

What ships

• Three vectors per privileged property, full cross-product, deterministic sorted order:
  • __proto__ — the direct CVE-2018-3721 vector.
  • constructor.prototype — bypasses guards that only block the literal __proto__ key (every object's constructor is a function whose .prototype IS Object.prototype).
  • prototype — the bare alias used by mongoose / handlebars / some hand-rolled merges.
• Shares the canonical PrivilegedProperties set with --mass-assign (admin, is_admin, isAdmin, role, roles, verified) so the same authz-bypass surface is exercised against the prototype layer.
• Caller credentials unchanged (Identity == nil), caller's existing top-level body fields preserved verbatim.
• Arrays, scalars, non-JSON bodies skipped. Already-present vector keys skipped per-vector.
• Off by default — process-wide effect persists across every concurrent user until the runtime restarts. Mirrors the gating of every other write-shaped mutator.

Files

• internal/mutate/prototype_pollution.go (new, ~210 lines incl. docstring + 3-vector table + Generate + injectPollution helper)
• internal/mutate/prototype_pollution_test.go (new, 13 tests)
• internal/cli/scan.go — flag wiring (scanProtoPollution var, --prototype-pollution flag, resetScanFlags, buildRegistry signature & body)
• internal/cli/buildregistry_forbidden_test.go — 2 new gating tests + every existing buildRegistry(…) call updated for the new 18th parameter
• README.md — new "Prototype pollution (--prototype-pollution)" section
• CHANGELOG.md — Unreleased / Added entry

Constraints honoured

• One improvement — single new mutator, no refactors, no sweeps.
• Tests updated — 13 new tests; full suite passes -race.
• README updated — new dedicated section.
• Architecture preserved — DefaultRegistry order unchanged (mutator registered inert when disabled, the existing not-in-DefaultRegistry contract is enforced by the new test).
• v0.1 criteria preserved — no changes to any existing detection / replay / parse code path; the mutator is purely additive and off-by-default.

Test plan

• go test ./... — all 13 packages green
• go test -race ./... — all 13 packages green
• go vet ./... — clean
• go build ./cmd/possession — binary builds
• possession scan --help | grep prototype-pollution — flag exposed with full help text
• 13 new unit tests cover: off-by-default, full cross-product cell coverage, per-vector body-shape invariants (with disjointness vs --mass-assign verified), caller-field preservation, non-JSON/array/empty body skip, already-present vector-key skip, determinism, credentials-unchanged, body non-aliasing, Name() stability, not-in-DefaultRegistry contract, end-to-end gating through buildRegistry (wordlist-on AND wordlist-off paths)