Defenses: No direct HTML injection — input is treated as JSON and merged into a config object. A client-side rendering function checks config.html to render custom content.
This page merges your JSON input into a config object, then renders content. No direct HTML injection — but the merge is dangerously naive.
CONCEPT: Prototype Pollution
Every JavaScript object inherits from Object.prototype. If an application does a naive deep merge/clone of user-controlled JSON, the attacker can set __proto__ properties that pollute all objects in the runtime. For example, {"__proto__": {"isAdmin": true}} would make ({}).isAdmin === true for every object. When combined with client-side rendering that checks obj.someProperty and uses it in innerHTML, this becomes an XSS vector — even though the attacker never directly injected HTML. Prototype pollution is particularly dangerous because it can affect code running anywhere in the application, not just at the injection point.
Submit JSON to configure the widget.