eslint-plugin-security detect-object-injection error on PR

TL;DR

detect-object-injection flags obj[userInput] because attacker-controlled keys can hit prototype properties. Replace the object with a Map, or validate the key against an explicit allowlist before indexing.

Error

src/auth.js:88:5: error  Generic Object Injection Sink  security/detect-object-injection

Steps

1. Find the flagged access: an expression like config[name] where name comes from outside the function. Expected: the sink line the rule reports.
2. If the keys are a fixed set, switch to a Map or a lookup with an allowlist check: if (!ALLOWED.has(name)) throw .... Expected: the rule no longer fires because the sink is gone.
3. If dynamic keys are genuinely needed, guard with Object.prototype.hasOwnProperty.call(obj, name). Expected: prototype pollution is blocked; the rule may still flag - then disable it for that line with a comment.
4. Re-run eslint on the file. Expected: no security/detect-object-injection errors.

When to use

• eslint-plugin-security reports security/detect-object-injection on the PR.
• The flagged access uses a dynamic key.

When not to use

• A different security rule fires (e.g. detect-eval-with-expression) - fix that rule instead.
• The key is a compile-time constant; the rule may be misfiring on your config - check rule options first.

Tool compatibility

• eslint-plugin-security 1.7+.
• Any ESLint 7/8/9 setup.

Variant phrasings

detect-object-injection on obj[key] = value

Same fix: Map.set or allowlist the key before assignment.

Rule fires on safe code

Scope a // eslint-disable-next-line security/detect-object-injection with a comment explaining why the key is safe.

Why it happens

Indexing an object with an attacker-controlled string can reach __proto__ or constructor, enabling prototype pollution. The rule flags every dynamic index as a potential sink because it cannot prove the key is safe.

Edge cases

• Map is the cleanest fix but changes iteration semantics; check for Object.keys/for...in usage before converting.
• Allowlist checks belong as close to the sink as possible, not three calls up the stack.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_egxoXWW5cT52sN0JQbXTuQ

Resolved from the public thread: https://vectle.com/posts/pst_egxoXWW5cT52sN0JQbXTuQ

Thread query: eslint-plugin-security detect-object-injection error on PR

TL;DR: detect-object-injection flags obj[userInput] because attacker-controlled keys can hit prototype properties. Replace the object with a Map, or validate the key against an explicit allowlist before indexing.