Adds bound parameters for enhanced security

README.md

@@ -188,7 +188,8 @@ let myQuery = {
 ```javascript
 /*Option 1: object notation*/ 
 let myQuery = {
-	sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT 3" /* required */,
+	sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT ?" /* required */,
+	QueryParams: [3],
 	db: "sampledb" /* optional. You could specify a database here or in the advance configuration option mentioned above*/
 };
 
@@ -211,7 +212,8 @@ athenaExpress
 (async () => {
 /*Option 1: object notation*/ 
 	let myQuery = {
-		sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT 3" /* required */,
+		sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT ?" /* required */,
+		QueryParams: [3],
 		db: "sampledb" /* optional. You could specify a database here or in the configuration constructor*/
 	};
 
@@ -262,7 +264,8 @@ const athenaExpress = new AthenaExpress(athenaExpressConfig);
 //Invoking a query on Amazon Athena
 (async () => {
 	let myQuery = {
-		sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT 3",
+		sql: "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT ?",
+		QueryParams: [3],
 		db: "sampledb"
 	};
 
@@ -297,10 +300,10 @@ const athenaExpressConfig = {
 const athenaExpress = new AthenaExpress(athenaExpressConfig);
 
 exports.handler = async event => {
-	const sqlQuery = "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT 3";
+	const sqlQuery = "SELECT elb_name, request_port, request_ip FROM elb_logs LIMIT ?";
 
 	try {
-		let results = await athenaExpress.query(sqlQuery);
+		let results = await athenaExpress.query(sqlQuery, [3]);
 		return results;
 	} catch (error) {
 		return error;

lib/athenaExpress.js

@@ -39,7 +39,25 @@ module.exports = class AthenaExpress {
         };
     }
 
-    async query(query) {
+	/**
+	 * Executes an Athena SQL Query.
+	 *
+	 * If the 'query' parameter is a string, SQL parameters should be
+	 * passed in via the 'queryParams' optional parameter.
+	 *
+	 * If the 'query' parameter is an object, parameters should be
+	 * passed in via the 'query.QueryParams' optional array.
+	 *
+	 * Examples:
+	 * await athenaExpress.query('SELECT * FROM movies WHERE movie_title = ?', ['Spider-Man']);
+	 * await athenaExpress
+	 * 	.query({ sql: 'SELECT * FROM movies WHERE movie_title = ?', QueryParams: ['Spider-Man']});
+	 *
+	 * @param {String|Object} query
+	 * @param {Array} [queryParams=[]] Optional
+	 * @returns {Promise<Object>}
+	 */
+	async query(query, queryParams) {
         const config = this.config;
 
         let initiateQueryInAthena = true;
@@ -66,6 +84,9 @@ module.exports = class AthenaExpress {
             if (loweredCaseKeys.hasOwnProperty("catalog")) {
                 config.catalog = loweredCaseKeys.catalog;
             }
+            if (loweredCaseKeys.hasOwnProperty("queryparams")) {
+                config.QueryParams = loweredCaseKeys.queryparams;
+            }
             if (loweredCaseKeys.hasOwnProperty("sql")) {
                 config.sql = loweredCaseKeys.sql;
             }
@@ -82,6 +103,7 @@ module.exports = class AthenaExpress {
             config.QueryExecutionId = query;
         } else {
             config.sql = query;
+            config.QueryParams = queryParams;
         }
 
         try {

lib/helpers.js

@@ -2,13 +2,14 @@
 //helpers.js
 
 const readline = require("readline"),
-    csv = require("csvtojson");
+    csv = require("csvtojson"),
+    SqlString = require("sqlstring");
 
 let s3Metadata = null;
 
 function startQueryExecution(config) {
     const params = {
-        QueryString: config.sql,
+        QueryString: SqlString.format(config.sql, config.QueryParams || []),
         WorkGroup: config.workgroup,
         ResultConfiguration: {
             OutputLocation: config.s3Bucket,

package.json

@@ -38,6 +38,7 @@
     "mocha-lcov-reporter": "^1.3.0"
   },
   "dependencies": {
-    "csvtojson": "^2.0.10"
+    "csvtojson": "^2.0.10",
+    "sqlstring": "^2.3.1"
   }
 }