chore: introduce sql injection

[cfabianski]

Description

A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.

Resolved or fixed issue:

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[cfabianski]

🚫 [Bearer] <javascript_lang_sql_injection> _{reported by reviewdog 🐶}

SQL injection vulnerability detected.

Description

Including unsanitized data, such as user input or request data, in raw SQL queries makes your application vulnerable to SQL injection attacks.

Remediations

❌ Avoid raw queries, especially those that contain unsanitized user input

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId);

Instead, consider the following approaches when writing SQL queries

✅ Validate query input wherever possible

  var rawId = req.params.userId
  if !(/[0-9]+/.test(rawId)) {
    // input is unexpected; don't make the query
  }

✅ Use prepared (or parameterized) statements when querying

Sequelize example -

  var sqlite = new Sequelize("sqlite::memory:");
  sqlite.query(
    "SELECT * FROM users WHERE ID = ?",
    { replacements: [req.params.userId] },
    type: sequelize.QueryTypes.SELECT
  )

Resources

• OWASP SQL injection explained
• OWASP SQL injection prevention cheat sheet