Merging user-controlled objects into a target without key filtering can pollute Object.prototype.
Sanitize object keys before merging. Use Object.create(null) for dictionaries.