T09 · Insecure Skill Coding Practices
- Location
performance.md:7- Finding
Raw Prisma Query Parameters May Be Disclosed Through Application Logs
- Content
View full analysis
Vulnerability Details
File Location:
performance.md:7-13
Vulnerability Type: Sensitive data exposure through unsafe query logging
Risk Level: Mediumts const prisma = new PrismaClient({ log: [{ emit: 'event', level: 'query' }], }) prisma.$on('query', (e) => { if (e.duration > 50) console.warn(e.duration, e.query, e.params) })Technical Analysis
The example logs
e.params, which contains the bound values supplied to the database query. Depending on the application, these values may include credentials, authentication tokens, password hashes, email addresses, session identifiers, financial information, or other personally identifiable information.Restricting the log to queries taking more than 50 milliseconds reduces log volume but does not sanitize the values. In production environments, standard output and standard error are commonly collected and transmitted to centralized logging or observability services. Consequently, this example can create an unintended network disclosure path and expand access to sensitive database values beyond the application and database.
This behavior exceeds the minimum information needed for routine performance monitoring. Query duration, operation name, model, row count, and a normalized query fingerprint are normally sufficient without recording raw parameter values.
Attack Path
- An application adopts the documented query-logging example.
- An attacker or ordinary user submits sensitive input that becomes a Prisma query parameter.
- The corresponding query takes more than 50 milliseconds.
- The callback writes the SQL and raw
e.paramsvalue toconsole.warn. - The deployment platform forwards console output to a local or third-party log aggregation service.
- An attacker with compromised log access, or an internal user with broader log permissions than database permissions, retrieves the sensitive value.
Impact Assessment
...[truncated 481 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
e.paramsfrom the default logging example. - Log only non-sensitive metadata such as duration, operation, model, and a normalized query fingerprint.
- Require explicit, temporary opt-in before enabling parameter logging.
- Restrict any parameter-level debugging to local or isolated non-production environments.
- If values must be recorded, apply structured redaction for passwords, tokens, cookies, authorization values, personal data, and application-defined sensitive fields.
- Configure strict access controls, encryption, short retention, and audit trails for centralized logs.
- Add a warning that Prisma query events can contain sensitive SQL parameters.
A safer default is:
ts prisma.$on('query', (e) => { if (e.duration > 50) { console.warn({ durationMs: e.duration, queryFingerprint: fingerprint(e.query), }) } })- Remove