Fix sQL query built by string interpolation in NestJS

A SQL string is assembled with a template literal or concatenation and passed to a database driver. Any value interpolated into it is executed as SQL, so a request parameter can read, modify, or destroy data the query was never meant to touch. Use the driver's parameter binding instead; every driver has it.

high likely NestJS CWE-89 / OWASP A03:2021

The vulnerable pattern in NestJS

HIGH likely SQL query built by string interpolation A03:2021 src/users/users.controller.ts:55:7 53 │ // sql-injection 54 │ const rows = await this.pool.query( 55 │ `SELECT id, role FROM users WHERE email = '${body.email}'`, │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ query text is built at runtime 56 │ )

This finding comes from the NestJS fixture in the owlwarden test suite. A value taken from the request is interpolated into SQL, so the caller controls part of the statement. That is enough to read other users' rows, bypass a WHERE clause, or drop a table.

The corrected handler

Use the repository API, or bind parameters on the query builder.

await this.repo
  .createQueryBuilder('user')
  .where('user.id = :id', { id })
  .getOne()

If you are not using NestJS

Pass the values as query parameters instead of interpolating them. Every driver supports it, and the binding is not optional formatting - it is what stops the value being parsed as SQL.

Check your own repository

npx owlwarden scan
npx owlwarden explain sql-injection

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other NestJS checks

Rules with a tested NestJS example.

sql-injection for every framework / All rules / owlwarden