SQL Injection via String Concatenation

SQLПрактика

Main had a single `findById` using a parameterized query — a textbook example. A teammate opens a PR adding `searchUsers` and `deleteUserByName` for a new admin panel. You are the security champion. Walk the diff and find every injection.

Клик по строке diff — напиши свой комментарий. Когда закончишь, жми «Отправить ревью».Туториал этого урока

11 import { pool } from './db'

22 import type { User } from './types'

33

4+export async function searchUsers(

5+ emailQuery: string,

6+ role: string,

7+ sortBy: string,

8+): Promise<User[]> {

9+ const sql = `

10+ SELECT * FROM users

11+ WHERE email LIKE '%${emailQuery}%'

12+ AND role = '${role}'

13+ ORDER BY ${sortBy}

14+ `

15+ const { rows } = await pool.query(sql)

16+ return rows

17+}

18+

19+export async function deleteUserByName(name: string): Promise<void> {

20+ await pool.query(`DELETE FROM users WHERE name = '${name}'`)

21+}

22+

423 export async function findById(id: string): Promise<User | null> {

524 const { rows } = await pool.query(

625 'SELECT * FROM users WHERE id = $1',

726 [id],

827 )

928 return rows[0] ?? null

1029 }

0 комментариев

ArchCase

ArchCase

SQL Injection via String Concatenation