fix(db): prevent prototype pollution via select() alias paths (#1584)

.changeset/select-alias-prototype-pollution.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/db': patch
+---
+
+Fix prototype pollution via `select()` alias paths. Aliases were split on `.` and walked into the result object without sanitization, so a query like `select(() => ({ ['__proto__.polluted']: ... }))` (or any segment matching `__proto__`, `prototype`, or `constructor`) could mutate `Object.prototype`. The select compiler now rejects unsafe alias path segments with a new `UnsafeAliasPathError`. Fixes #1584.

packages/db/src/errors.ts

@@ -442,6 +442,16 @@ export class QueryCompilationError extends TanStackDBError {
   }
 }
 
+export class UnsafeAliasPathError extends QueryCompilationError {
+  constructor(segment: string) {
+    super(
+      `Unsafe alias path segment "${segment}" is not allowed in .select(). ` +
+        `Aliases must not contain "__proto__", "prototype", or "constructor".`,
+    )
+    this.name = `UnsafeAliasPathError`
+  }
+}
+
 export class DistinctRequiresSelectError extends QueryCompilationError {
   constructor() {
     super(`DISTINCT requires a SELECT clause.`)

packages/db/src/query/compiler/select.ts

@@ -5,7 +5,10 @@ import {
   Value as ValClass,
   isExpressionLike,
 } from '../ir.js'
-import { AggregateNotSupportedError } from '../../errors.js'
+import {
+  AggregateNotSupportedError,
+  UnsafeAliasPathError,
+} from '../../errors.js'
 import { compileExpression, isCaseWhenConditionTrue } from './evaluators.js'
 import { containsAggregate } from './group-by.js'
 import type {
@@ -39,6 +42,16 @@ function unwrapVal(input: any): any {
   return input
 }
 
+const UNSAFE_ALIAS_SEGMENTS = new Set([`__proto__`, `prototype`, `constructor`])
+
+function assertSafeAliasSegments(segments: ReadonlyArray<string>): void {
+  for (const seg of segments) {
+    if (UNSAFE_ALIAS_SEGMENTS.has(seg)) {
+      throw new UnsafeAliasPathError(seg)
+    }
+  }
+}
+
 /**
  * Processes a merge operation by merging source values into the target path
  */
@@ -47,6 +60,7 @@ function processMerge(
   namespacedRow: NamespacedRow,
   selectResults: Record<string, any>,
 ): void {
+  assertSafeAliasSegments(op.targetPath)
   const value = op.source(namespacedRow)
   if (value && typeof value === `object`) {
     // Ensure target object exists
@@ -89,6 +103,7 @@ function processNonMergeOp(
 ): void {
   // Support nested alias paths like "meta.author.name"
   const path = op.alias.split(`.`)
+  assertSafeAliasSegments(path)
   if (path.length === 1) {
     selectResults[op.alias] = op.compiled(namespacedRow)
   } else {
@@ -283,6 +298,9 @@ function addFromObject(
   ops: Array<SelectOp>,
 ) {
   for (const [key, value] of Object.entries(obj)) {
+    if (!key.startsWith(`__SPREAD_SENTINEL__`)) {
+      assertSafeAliasSegments(key.split(`.`))
+    }
     if (key.startsWith(`__SPREAD_SENTINEL__`)) {
       const rest = key.slice(`__SPREAD_SENTINEL__`.length)
       const splitIndex = rest.lastIndexOf(`__`)

packages/db/tests/query/select.test.ts

@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, it } from 'vitest'
 import { createCollection } from '../../src/collection/index.js'
-import { createLiveQueryCollection } from '../../src/query/index.js'
+import { createLiveQueryCollection, queryOnce } from '../../src/query/index.js'
+import { UnsafeAliasPathError } from '../../src/errors.js'
 import { mockSyncCollectionOptions } from '../utils.js'
 import { upper } from '../../src/query/builder/functions.js'
 
@@ -129,3 +130,45 @@ describe(`nested select projections`, () => {
     })
   })
 })
+
+function prototypeHasOwn(prop: string): boolean {
+  return Object.prototype.hasOwnProperty.call(Object.prototype, prop)
+}
+
+describe(`select() alias prototype pollution`, () => {
+  let users: ReturnType<typeof createUsers>
+
+  beforeEach(() => {
+    users = createUsers()
+  })
+
+  it(`should reject __proto__ in alias path and not pollute Object.prototype`, async () => {
+    const hadBefore = prototypeHasOwn(`polluted`)
+
+    await expect(
+      queryOnce((q) =>
+        q.from({ user: users }).select(({ user }) => ({
+          [`__proto__.polluted`]: user.name,
+        })),
+      ),
+    ).rejects.toThrow(UnsafeAliasPathError)
+
+    expect(prototypeHasOwn(`polluted`)).toBe(hadBefore)
+    expect(prototypeHasOwn(`polluted`)).toBe(false)
+  })
+
+  it(`should reject constructor in alias path and not pollute Object.prototype`, async () => {
+    const hadBefore = prototypeHasOwn(`polluted`)
+
+    await expect(
+      queryOnce((q) =>
+        q.from({ user: users }).select(({ user }) => ({
+          [`constructor.prototype.polluted`]: user.name,
+        })),
+      ),
+    ).rejects.toThrow(UnsafeAliasPathError)
+
+    expect(prototypeHasOwn(`polluted`)).toBe(hadBefore)
+    expect(prototypeHasOwn(`polluted`)).toBe(false)
+  })
+})