Prototype Pollution in Django with Cockroachdb

Prototype pollution in Django with Cockroachdb typically arises when user-controlled input is merged into mutable objects that are later used to construct queries or serialize data. Cockroachdb, as a PostgreSQL-compatible distributed database, does not inherently introduce prototype pollution, but its usage patterns in Django can amplify risk if data handling is inconsistent.

Consider a Django view that builds a filter dictionary from request query parameters and passes it to a Cockroachdb-backed model query:

import requests
params = {
    'filters': {
        'account_id': 123,
        '__proto__': {'is_admin': True}
    }
}
r = requests.get('https://api.example.com/search', params=params)

If the view does filters = request.GET.dict() and then updates a base filter dict with user input, the __proto__ key can pollute the dictionary’s prototype chain in JavaScript contexts (when data is later serialized and consumed by a frontend), or it can be mistakenly interpreted as a field name when constructing dynamic query kwargs, leading to unexpected behavior or privilege escalation.

Django’s query building does not directly use JavaScript prototypes, but if the polluted data is stored and later retrieved by Cockroachdb and rendered in JSON responses, the injected keys may be persisted and echoed back to other clients. This can facilitate data exfiltration or logic manipulation when the data is consumed by a JavaScript application that relies on prototype inheritance. The risk is higher when the API serves as a backend for rich client-side apps that merge server data with client prototypes.

Another exposure path involves Django serializers and Cockroachdb schema flexibility. If a serializer uses ModelSerializer with extra_kwargs or dynamic field sets, and user input influences which fields are included or how nested objects are built, an attacker can inject keys like __class__ or __mro__ that affect object reconstruction in memory. When these objects are saved to Cockroachdb via Django’s ORM, the polluted attributes may be stored, and subsequent queries may inadvertently expose or misuse them.

The 12 parallel security checks in middleBrick specifically test such input validation and data exposure paths. For example, the Input Validation check sends probes that include prototype pollution payloads (e.g., {"__proto__": {"isAdmin": true}}) and verifies whether the API reflects or persists them. The Data Exposure check ensures that sensitive fields are not inadvertently returned when prototype-polluted objects are serialized. These checks map findings to OWASP API Top 10 A05:2023 Security Misconfiguration and A03:2023 Injection, providing remediation guidance tailored to API inputs that influence database operations.

Remediation focuses on strict input validation, avoiding direct merging of user input into query dictionaries, and ensuring serialized outputs are sanitized before storage or transmission.

1. Use Django’s Q objects and explicit filtering instead of dynamic kwargs built from raw user input:

from django.db.models import Q
from myapp.models import Account

# Unsafe: directly using user input in kwargs
# filters = request.GET.dict()
# accounts = Account.objects.filter(**filters)  # risk

# Safe: explicit allowlist
allowed_keys = {'account_id', 'status', 'created_at'}
filters = {k: v for k, v in request.GET.items() if k in allowed_keys}
accounts = Account.objects.filter(
    Q(account_id=filters.get('account_id')) &
    Q(status=filters.get('status'))
)

This prevents prototype keys from becoming query parameters and ensures Cockroachdb receives only intended filter conditions.

2. When using Cockroachdb with JSON fields, validate and sanitize JSON input before saving:

from django.db import models
import json

class Profile(models.Model):
    settings = models.JSONField()

    def set_settings(self, raw_data):
        # Validate against a schema
        if 'theme' in raw_data:
            self.settings['theme'] = raw_data['theme']
        if 'preferences' in raw_data:
            # Deep copy to avoid mutating input
            import copy
            self.settings['preferences'] = copy.deepcopy(raw_data['preferences'])
        self.save()

3. For APIs that return data to JavaScript clients, remove or rename dangerous keys before serialization:

import copy

def sanitize_for_output(data):
    safe = copy.deepcopy(data)
    if '__proto__' in safe:
        del safe['__proto__']
    if 'constructor' in safe:
        del safe['constructor']
    return safe

# In a view
response_data = sanitize_for_output(serializer.data)
return JsonResponse(response_data)

middleBrick’s LLM/AI Security checks complement these practices by verifying that endpoints do not leak system prompts or expose executable code in responses, which is especially important when API data feeds AI-driven clients. The GitHub Action can enforce that any API returning prototype-polluted patterns fails the build, and the MCP Server allows scanning directly from IDEs during development.