Conversation
![private-semgrep-app[bot]](https://avatars.githubusercontent.com/in/948798?s=60&v=4){kind=small}
| ); | ||
|
|
||
| // proruleid: pg-express | ||
| const q1 = pgClient.query(`SELECT pg_sleep(${req.body.sleep});`); |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>test.js</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L46 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 46] req</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L46 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 46] pgClient</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by pg-express.
You can view more details about this finding in the Semgrep AppSec Platform.
| const client = new Client(); | ||
| await client.connect(); | ||
| // proruleid: pg-express | ||
| const res = await client.query( |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>test.js</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L39 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 39] req</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L37 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 37] client</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
To resolve this comment:
✨ Commit Assistant fix suggestion
| const res = await client.query( | |
| const queryText = "INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ($1, $2, 'Pending')"; | |
| const queryValues = [req.query.profileTitle, req.query.profileBody]; | |
| const res = await client.query(queryText, queryValues); |
View step-by-step instructions
- Identify the SQL queries that are constructed using string concatenation with user input, such as
req.query.profileTitleandreq.query.profileBody. - Replace these queries with parameterized queries to prevent SQL injection. For example, change:
to:
pool.query( "INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ('" + req.query.profileTitle + "', '" + req.query.profileBody + "', 'Pending');" );
const queryText = "INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ($1, $2, 'Pending')"; const queryValues = [req.query.profileTitle, req.query.profileBody]; pool.query(queryText, queryValues);
- Apply the same change to other similar queries, such as the one using
client.query. - Ensure that all user inputs used in SQL queries are passed as parameters in the query method to separate SQL commands from user data.
Using parameterized queries helps prevent SQL injection by ensuring that user inputs are treated as data rather than executable code.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by pg-express.
You can view more details about this finding in the Semgrep AppSec Platform.
| const q2 = pgClient.query(text, values); | ||
|
|
||
| // proruleid: pg-express | ||
| const q3 = cl2.connect("something").query(text1); |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>test.js</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] req</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] `</a>"]
v3["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L28 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 28] text1</a>"]
end
v2 --> v3
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L52 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 52] cl2.connect("something")</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by pg-express.
You can view more details about this finding in the Semgrep AppSec Platform.
| async function test2(req, res, next) { | ||
| const pool = new Pool(a); | ||
| // proruleid: pg-express | ||
| pool.query( |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>test.js</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L18 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 18] req</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/bandarisantosh/bad-python-app/blob/5c5e3a9d011b1e813419749b3b7e8e820d70da3f/test.js#L16 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 16] pool</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
To resolve this comment:
✨ Commit Assistant fix suggestion
| pool.query( | |
| pool.query( | |
| "INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ($1, $2, 'Pending');", | |
| [req.query.profileTitle, req.query.profileBody] | |
| ); |
View step-by-step instructions
- Change the SQL query to use parameterized queries instead of string concatenation. This prevents SQL injection by separating SQL commands from user data.
- Replace the query string with placeholders for the dynamic values. For example, change the query to:
"INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ($1, $2, 'Pending');". - Pass the dynamic values as an array in the second argument of the
querymethod. For example, use:pool.query("INSERT INTO profiledb (profilename, profiledescription, approved) VALUES ($1, $2, 'Pending');", [req.query.profileTitle, req.query.profileBody]);. - Repeat the above steps for any other queries that use user input directly in the SQL string.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by pg-express.
You can view more details about this finding in the Semgrep AppSec Platform.
1 participant
No description provided.