Fix sQL query built by string interpolation in Sails.js
A SQL string is assembled with a template literal or concatenation and passed to a database driver. Any value interpolated into it is executed as SQL, so a request parameter can read, modify, or destroy data the query was never meant to touch. Use the driver's parameter binding instead; every driver has it.
high likely Sails.js CWE-89 / OWASP A03:2021
The vulnerable pattern in Sails.js
This finding comes from the Sails.js fixture in the owlwarden test
suite, in /auth.
A value taken from the request is interpolated into SQL, so the caller controls part of the statement. That is enough to read other users' rows, bypass a WHERE clause, or drop a table.
The corrected handler
Use Waterline's query builder, or bind parameters on a raw query.
await User.find({ id: inputs.id })
// raw query: bind, do not interpolate
await sails.getDatastore().sendNativeQuery('SELECT * FROM users WHERE id = $1', [inputs.id])If you are not using Sails.js
Pass the values as query parameters instead of interpolating them. Every driver supports it, and the binding is not optional formatting - it is what stops the value being parsed as SQL.
Check your own repository
npx owlwarden scan
npx owlwarden explain sql-injectionRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Sails.js checks
Rules with a tested Sails.js example.
- cors-permissive medium Cross-origin policy accepts any origin
- hardcoded-secret high Credential hardcoded in source
- insecure-cookie medium Cookie set without its protective attributes
- install-lifecycle-script medium Package declares an install-time script
- open-redirect medium Redirect target comes from the caller
- security-headers-missing medium Security headers are not configured
- sensitive-data-logged medium Sensitive data written to a log
- ssrf high Server fetches a URL the caller controls
- stack-trace-leak high Stack trace leaked in error response
- weak-crypto high Broken cryptographic primitive protecting a secret