Prototype Pollution in Fiber with Cockroachdb

Prototype Pollution in a Fiber application that uses CockroachDB as the backend can arise when user-supplied data is merged into objects that are later used to construct database queries or parameters. In JavaScript, objects inherit properties from their prototype. If an application copies or merges user input into a target object (for example, to build a WHERE clause or an update document), an attacker can inject properties such as __proto__, constructor.prototype, or other inherited properties that affect behavior across instances.

With CockroachDB, which speaks PostgreSQL wire protocol and is commonly accessed via a PostgreSQL client in Node.js, the risk is not direct database corruption via prototype pollution, but rather unsafe construction of query inputs. For example, if you use a library that merges request body into an object representing query conditions, an attacker can add or modify properties that change the semantics of generated SQL, potentially bypassing filters or escalating permissions at the application layer.

Consider a route in Fiber that builds a filter object directly from request query parameters:

const { Router } = require('fiber');
const { Pool } = require('cockroachdb'); // or 'pg' with CockroachDB wire protocol
const pool = new Pool({ connectionString: 'postgresql://user:pass@localhost:26257/db' });

const app = new Router();
app.get('/users', async (req, res) => {
  const filters = { status: 'active' };
  // UNSAFE: merging query params into the filters object
  Object.assign(filters, req.query);
  const result = await pool.query('SELECT * FROM users WHERE status = $1 AND role = $2', [filters.status, filters.role]);
  res.send(result.rows);
});

If an attacker sends a request like ?__proto__.isAdmin=true, and the merging approach is permissive, the injected property may propagate to other objects that rely on prototype inheritance, leading to unexpected behavior. More critically, if query building logic uses shallow copies rather than strict validation, attacker-controlled keys can alter which columns are selected or compared, bypassing intended access controls.

The 12 security checks run by middleBrick (including BOLA/IDOR, Input Validation, and Unsafe Consumption) are designed to detect such risks in unauthenticated scans. For this Fiber + CockroachDB setup, findings may highlight unsafe object merging, missing schema constraints, or lack of input sanitization that could enable injection or logic manipulation. middleBrick’s OpenAPI/Swagger analysis (with full $ref resolution) cross-references spec definitions against runtime behavior to surface these issues without requiring credentials.

Remediation focuses on strict input validation and avoiding prototype-unsafe operations. Do not merge raw query parameters into objects used for SQL construction. Instead, explicitly allowlist expected parameters and map them to safe query inputs. This prevents attacker-controlled keys from influencing object inheritance or query structure.

To secure a Fiber application using CockroachDB, adopt explicit parameter handling and avoid merging user input into objects that influence SQL generation. Use parameterized queries consistently and validate each field against an allowlist. Below are concrete, safe patterns.

Safe route with explicit field extraction

Instead of merging query parameters, extract only the fields you expect and map them to query arguments:

const { Router } = require('fiber');
const { Pool } = require('cockroachdb');
const pool = new Pool({ connectionString: 'postgresql://user:pass@localhost:26257/db' });

const app = new Router();
app.get('/users', async (req, res) => {
  const { role, department } = req.query; // explicit extraction
  const allowedRoles = ['admin', 'user', 'guest'];
  const allowedDepts = ['engineering', 'sales', 'hr'];
  const safeRole = allowedRoles.includes(role) ? role : 'user';
  const safeDept = allowedDepts.includes(department) ? department : 'engineering';

  const result = await pool.query(
    'SELECT id, name, role, department FROM users WHERE role = $1 AND department = $2',
    [safeRole, safeDept]
  );
  res.send(result.rows);
});

Using a validation library to enforce schema

Integrate a validation library (e.g., Joi) to reject unexpected fields and ensure types match. This prevents prototype pollution vectors that rely on unexpected keys:

const { Router } = require('fiber');
const { Pool } = require('cockroachdb');
const Joi = require('joi');
const pool = new Pool({ connectionString: 'postgresql://user:pass@localhost:26257/db' });

const app = new Router();
const filterSchema = Joi.object({
  role: Joi.string().valid('admin', 'user', 'guest').default('user'),
  department: Joi.string().valid('engineering', 'sales', 'hr').default('engineering')
}).unknown(false); // reject unknown keys

app.get('/users', async (req, res) => {
  const { error, value } = filterSchema.validate(Object.fromEntries(req.query));
  if (error) {
    return res.status(400).send({ error: error.details });
  }
  const result = await pool.query(
    'SELECT id, name, role, department FROM users WHERE role = $1 AND department = $2',
    [value.role, value.department]
  );
  res.send(result.rows);
});

Prepared statements and parameterized queries

Always use parameterized queries or prepared statements. Never concatenate user input into SQL strings. With CockroachDB’s PostgreSQL compatibility, use placeholders ($1, $2) and pass parameters separately:

const result = await pool.query('SELECT * FROM users WHERE email = $1', [userSuppliedEmail]);

For the Pro plan, middleBrick’s continuous monitoring can detect deviations such as unsafe object merges or missing validation in your API surface, and findings map to frameworks like OWASP API Top 10 to guide fixes. The CLI tool (middlebrick scan <url>) and GitHub Action can integrate checks into your CI/CD pipeline to fail builds if risk scores exceed your chosen threshold.