Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
The Phoenix JavaScript presence client (assets/js/phoenix/presence.js) tests whether a presence already exists using a bare truthiness check (state[key]) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an Object.prototype member (proto, constructor, toString, hasOwnProperty, and similar) makes the lookup return the inherited Object.prototype object instead …