JS原型链污染一个题

题目来源：LitCTF-2025-多重宇宙日记

题目提示打原型链

先注册一个账户登录，会来到/api/profile

查看源码

<script>
    // 更新表单的JS提交
    document.getElementById('profileUpdateForm').addEventListener('submit', async function(event) {
        event.preventDefault();
        const statusEl = document.getElementById('updateStatus');
        const currentSettingsEl = document.getElementById('currentSettings');
        statusEl.textContent = '正在更新...';

        const formData = new FormData(event.target);
        const settingsPayload = {};
        // 构建 settings 对象，只包含有值的字段
        if (formData.get('theme')) settingsPayload.theme = formData.get('theme');
        if (formData.get('language')) settingsPayload.language = formData.get('language');
        // ...可以添加其他字段

        try {
            const response = await fetch('/api/profile/update', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                },
                body: JSON.stringify({ settings: settingsPayload }) // 包装在 "settings"键下
            });
            const result = await response.json();
            if (response.ok) {
                statusEl.textContent = '成功: ' + result.message;
                currentSettingsEl.textContent = JSON.stringify(result.settings, null, 2);
                // 刷新页面以更新导航栏（如果isAdmin状态改变）
                setTimeout(() => window.location.reload(), 1000);
            } else {
                statusEl.textContent = '错误: ' + result.message;
            }
        } catch (error) {
            statusEl.textContent = '请求失败: ' + error.toString();
        }
    });

    // 发送原始JSON的函数
    async function sendRawJson() {
        const rawJson = document.getElementById('rawJsonSettings').value;
        const statusEl = document.getElementById('rawJsonStatus');
        const currentSettingsEl = document.getElementById('currentSettings');
        statusEl.textContent = '正在发送...';
        try {
            const parsedJson = JSON.parse(rawJson); // 确保是合法的JSON
            const response = await fetch('/api/profile/update', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                },
                body: JSON.stringify(parsedJson) // 直接发送用户输入的JSON
            });
            const result = await response.json();
            if (response.ok) {
                statusEl.textContent = '成功: ' + result.message;
                currentSettingsEl.textContent = JSON.stringify(result.settings, null, 2);
                 // 刷新页面以更新导航栏（如果isAdmin状态改变）
                setTimeout(() => window.location.reload(), 1000);
            } else {
                statusEl.textContent = '错误: ' + result.message;
            }
        } catch (error) {
             statusEl.textContent = '请求失败或JSON无效: ' + error.toString();
        }
    }
</script>