Unsanitized input in SQL query

  • Rule ID: javascript_lang_sql_injection
  • Languages: javascript
  • Source: sql_injection.yml

Description

Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.

Remediations

  • Do not use raw SQL queries that concatenate unsanitized input directly.
    var sqlite = new Sequelize("sqlite::memory:");
    sqlite.query("SELECT * FROM users WHERE ID = " + req.params.userId); // unsafe
  • Do validate all query inputs to ensure they meet expected patterns or values before using them in a query.
    var rawId = req.params.userId
    if !(/[0-9]+/.test(rawId)) {
      // input is unexpected; don't make the query
    }
  • Do use prepared (or parameterized) statements for querying databases to safely include external input.
    var sqlite = new Sequelize("sqlite::memory:");
    sqlite.query(
      "SELECT * FROM users WHERE ID = ?",
      { replacements: [req.params.userId] },
      type: sequelize.QueryTypes.SELECT
    )

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=javascript_lang_sql_injection

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=javascript_lang_sql_injection