XCracks
Sample data
D
CRITICAL
Proposed SQL Injection via template literal
File src/auth/session.ts:47
Repository api-service
Rule sql-injection/template-literal
Detected Jan 14, 2025
User-controlled input is concatenated directly into a SQL query string using a template literal on line 47. This allows an attacker to inject arbitrary SQL by manipulating the userId parameter, potentially exfiltrating or modifying database contents.
Proposed fix — src/auth/session.ts
+7 lines -3 lines
@@ -44,9 +44,13 @@ export async function getUserSession(userId: string)
44 44 const db = getDatabase();
45 45 try {
46 - const query = `SELECT * FROM users WHERE id = ${userId}`;
47 - const user = await db.execute(query);
48 - return user.rows[0] ?? null;
46 + const stmt = db.prepare(
47 + 'SELECT id, email, role FROM users WHERE id = ?'
48 + );
49 + const row = stmt.get(userId);
50 + if (!row) return null;
51 + return { id: row.id, email: row.email, role: row.role };
49 52 } catch (err) {
50 53 throw new DatabaseError(err);
51 54 }
Test results All passing
auth.session.test.ts
12 passed 0.38s
auth.integration.test.ts
8 passed 1.12s
db.query.test.ts
21 passed 0.54s
Review action
Approve fixPipeline stage