René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Security] Prototype pollution via server-supplied column names in result rows","articleBody":"Split from #3651 as suggested by @charmander.\n\n## Summary\n\nWhen a PostgreSQL server returns column names like `__proto__`, `constructor`, or `toString`, these are used as object keys in result rows without any sanitization. A rogue or compromised PostgreSQL server can exploit this to pollute `Object.prototype` on the client.\n\n## Affected code\n\n`packages/pg/lib/result.js` — both `addFields()` and `parseRow()`:\n\n```js\n// addFields() builds the pre-built empty result object:\nconst row = {}\nfor (let i = 0; i \u003c fieldDescriptions.length; i++) {\n  const desc = fieldDescriptions[i]\n  row[desc.name] = null  // desc.name comes from server\n}\nthis._prebuiltEmptyResultObject = { ...row }\n\n// parseRow() assigns parsed values using server-supplied field names:\nparseRow(rowData) {\n  const row = { ...this._prebuiltEmptyResultObject }\n  for (let i = 0, len = rowData.length; i \u003c len; i++) {\n    const field = this.fields[i].name  // server-controlled\n    row[field] = this._parsers[i](v)   // value also server-controlled\n  }\n  return row\n}\n```\n\n## Threat model\n\nThis is a **rogue server** scenario, not a trusted-config issue. If a client connects to a malicious PostgreSQL server (e.g. via DNS hijack, MITM without TLS verification, or a compromised host), the server controls the column names in `RowDescription` messages. A column named `__proto__` with a crafted value can pollute the prototype chain of all objects in the Node.js process.\n\n## Steps to reproduce\n\n1. Set up a mock PostgreSQL server that returns a `RowDescription` with a field named `__proto__` and a `DataRow` with the value `{\"polluted\": true}` (as a JSON/text column)\n2. Connect a `pg` client to this server and execute any query\n3. After the result is parsed, check `({}).polluted` — it will be `true`\n\n## Impact\n\n- Denial of service (crash or undefined behavior in downstream code)\n- Potential RCE depending on how the application uses objects after pollution\n\n## Suggested fix\n\nUse `Object.create(null)` instead of `{}` for result rows, or reject/rename column names that collide with `Object.prototype` properties:\n\n```js\nconst row = Object.create(null)\n```","author":{"url":"https://github.com/eddieran","@type":"Person","name":"eddieran"},"datePublished":"2026-04-13T09:19:04.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/3654/node-postgres/issues/3654"}