Fix sQL query built by string interpolation in Elysia
A SQL string is assembled with a template literal or concatenation and passed to a database driver. Any value interpolated into it is executed as SQL, so a request parameter can read, modify, or destroy data the query was never meant to touch. Use the driver's parameter binding instead; every driver has it.
high likely Elysia CWE-89 / OWASP A03:2021
The vulnerable pattern in Elysia
This finding comes from the Elysia fixture in the owlwarden test suite. A value taken from the request is interpolated into SQL, so the caller controls part of the statement. That is enough to read other users' rows, bypass a WHERE clause, or drop a table.
The corrected handler
Bind the value as a parameter. Elysia's `t` schema validates the shape; it does not make a string safe to concatenate.
const rows = await pool.query('SELECT id, role FROM users WHERE email = $1', [body.email])If you are not using Elysia
Pass the values as query parameters instead of interpolating them. Every driver supports it, and the binding is not optional formatting - it is what stops the value being parsed as SQL.
Check your own repository
npx owlwarden scan
npx owlwarden explain sql-injectionRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Elysia checks
Rules with a tested Elysia example.
- cors-permissive medium Cross-origin policy accepts any origin
- hardcoded-secret high Credential hardcoded in source
- insecure-cookie medium Cookie set without its protective attributes
- install-lifecycle-script medium Package declares an install-time script
- open-redirect medium Redirect target comes from the caller
- security-headers-missing medium Security headers are not configured
- sensitive-data-logged medium Sensitive data written to a log
- ssrf high Server fetches a URL the caller controls
- stack-trace-leak high Stack trace leaked in error response
- weak-crypto high Broken cryptographic primitive protecting a secret