Prototype pollution through bracketed query keys

A query string of the form `a[__proto__][x]=1` writes through to the object prototype during parsing, before any application code sees the request.

SyntheticThis advisory is invented for the demonstration. qs is a real package; nothing described here has been reported against it.