Fix sQL query built by string interpolation in Next.js
A SQL string is assembled with a template literal or concatenation and passed to a database driver. Any value interpolated into it is executed as SQL, so a request parameter can read, modify, or destroy data the query was never meant to touch. Use the driver's parameter binding instead; every driver has it.
high likely Next.js CWE-89 / OWASP A03:2021
The vulnerable pattern in Next.js
This finding comes from the Next.js fixture in the owlwarden test
suite, in /api/login.
A value taken from the request is interpolated into SQL, so the caller controls part of the statement. That is enough to read other users' rows, bypass a WHERE clause, or drop a table.
The corrected handler
Use a parameterised query, or Prisma's tagged $queryRaw which binds automatically.
// node-postgres
await db.query('SELECT * FROM users WHERE id = $1', [id])
// Prisma: the tagged form binds; $queryRawUnsafe does not
await prisma.$queryRaw`SELECT * FROM users WHERE id = ${id}`If you are not using Next.js
Pass the values as query parameters instead of interpolating them. Every driver supports it, and the binding is not optional formatting - it is what stops the value being parsed as SQL.
Check your own repository
npx owlwarden scan
npx owlwarden explain sql-injectionRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Next.js checks
Rules with a tested Next.js example.
- cors-permissive medium Cross-origin policy accepts any origin
- hardcoded-secret high Credential hardcoded in source
- insecure-cookie medium Cookie set without its protective attributes
- install-lifecycle-script medium Package declares an install-time script
- open-redirect medium Redirect target comes from the caller
- sensitive-data-logged medium Sensitive data written to a log
- ssrf high Server fetches a URL the caller controls
- stack-trace-leak high Stack trace leaked in error response
- weak-crypto high Broken cryptographic primitive protecting a secret