{"id":"d429942e5365e626","repo":"sidorares/node-mysql2","slug":"the-field-name-field-can-t-be-the-same-as-an","errorCode":null,"errorMessage":"The field name (${field}) can't be the same as an object's private property.","messagePattern":"The field name \\((.+?)\\) can't be the same as an object's private property\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/helpers.js","lineNumber":76,"sourceCode":"\n  return !!list;\n}\n\nexports.typeMatch = typeMatch;\n\nconst privateObjectProps = new Set([\n  '__defineGetter__',\n  '__defineSetter__',\n  '__lookupGetter__',\n  '__lookupSetter__',\n  '__proto__',\n]);\n\nexports.privateObjectProps = privateObjectProps;\n\nconst fieldEscape = (field, isEval = true) => {\n  if (privateObjectProps.has(field)) {\n    throw new Error(\n      `The field name (${field}) can't be the same as an object's private property.`\n    );\n  }\n\n  return isEval ? srcEscape(field) : field;\n};\nexports.fieldEscape = fieldEscape;\n","sourceCodeStart":58,"sourceCodeEnd":84,"githubUrl":"https://github.com/sidorares/node-mysql2/blob/5ebe8903d6aea2d8ea1490e11b52491526e50f19/lib/helpers.js#L58-L84","documentation":"fieldEscape() rejects column/field names that collide with JavaScript Object private/prototype properties (`__proto__`, `__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`). Assigning such a name as a property during row assembly would corrupt the result object's prototype chain. This is a prototype-pollution guard applied when building nested/evaluated field names.","triggerScenarios":"A MySQL table whose column name (or a nestTables field name) is literally one of those reserved prototype property strings, e.g. `SELECT __proto__ FROM t`. Also reachable when rowsAsArray/nestTables is used and a field name matches the blocklist.","commonSituations":"A schema with a column named `__proto__` (rare but possible); generated/migrated schemas with dunder column names; using `nestTables` where a table name collides.","solutions":["Alias the offending column in the query: `SELECT __proto__ AS proto_val FROM t`.","Rename the column in the schema to a non-reserved name.","Use `rowsAsArray: true` to receive rows as arrays instead of objects, avoiding property assignment entirely."],"exampleFix":"// before\nconnection.query('SELECT __proto__ FROM t');\n\n// after\nconnection.query('SELECT __proto__ AS proto_val FROM t');","handlingStrategy":"validation","validationCode":"const privateObjectProps = new Set(['__proto__','__defineGetter__','__defineSetter__','__lookupGetter__','__lookupSetter__']);\nfunction assertSafeFieldNames(fields) {\n  fields.forEach((f) => {\n    if (privateObjectProps.has(f)) throw new Error(`Field '${f}' collides with an object prototype property; alias it in SQL.`);\n  });\n}","typeGuard":"function isSafeFieldName(name) {\n  return !privateObjectProps.has(name);\n}","tryCatchPattern":null,"preventionTips":["Alias dunder-named columns in your SELECT list.","Consider rowsAsArray: true for schemas you do not control.","Reject dunder column names at schema-design time."],"tags":["fields","parsing","prototype-pollution","security"],"analyzedSha":"5ebe8903d6aea2d8ea1490e11b52491526e50f19","analyzedAt":"2026-08-03T18:58:53.602Z","schemaVersion":2}