Vulnerable branch #109
Vulnerable branch #109
Conversation
![Amplify [Lab]](https://avatars.githubusercontent.com/in/347747?s=40&u=f167c38980969fad1d181fdacb66403b97c6399a&v=4){kind=avatar}
✨ Amplify has finished checking this pull requestSecurity Pipeline
Vulnerabilities Detected
Note For more details, visit Amplify Security. |
![amplify-lab[bot]](https://avatars.githubusercontent.com/in/347747?s=60&v=4){kind=small}
|
|
||
| // vuln-code-snippet start unionSqlInjectionChallenge dbSchemaChallenge | ||
| module.exports = function searchProducts() { | ||
| return (req: Request, res: Response, next: NextFunction) => { | ||
| let criteria: any = req.query.q === 'undefined' ? '' : req.query.q ?? '' | ||
| criteria = (criteria.length <= 200) ? criteria : criteria.substring(0, 200) | ||
| console.log(criteria) | ||
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge |
There was a problem hiding this comment.
Warning
Amplify has been notified that this line contains a vulnerability 🕷️.
Vulnerability: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact: HIGH
Guidance: ✅
Code Fix: ✅
Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.
Note
Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?
![Amplify [Local]](https://avatars.githubusercontent.com/in/327173?s=40&u=385f4cba7826c99f3e2aa6073e33099024585247&v=4){kind=avatar}
✨ Amplify has finished checking this pull requestSecurity Pipeline
Vulnerabilities Detected
Note For more details, visit Amplify Security. |
![amplify-local[bot]](https://avatars.githubusercontent.com/in/327173?s=60&v=4){kind=small}
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge | ||
| .then(([products]: any) => { |
There was a problem hiding this comment.
Warning
Amplify has been notified that this line contains a vulnerability 🕷️.
Vulnerability: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact: HIGH
Guidance: ✅
Code Fix: ✅
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge | |
| .then(([products]: any) => { | |
| models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` }, type: models.sequelize.QueryTypes.SELECT }) // vuln-code-snippet vuln-line unionSqlInjectionChallenge dbSchemaChallenge | |
| .then((products: any) => { |
The code change fixes the SQL Injection vulnerability by using parameterized queries instead of directly concatenating user input into the SQL query string.
In the original code, the user input criteria is directly interpolated into the SQL query string using string concatenation. This allows an attacker to manipulate the criteria value and inject malicious SQL code, potentially leading to unauthorized access or data manipulation.
In the fixed code, the criteria value is passed as a named parameter :criteria in the SQL query string. The actual value is then provided separately as a replacement using the replacements option in the sequelize.query method. This ensures that the user input is treated as a parameter and not as part of the SQL query itself, effectively preventing SQL Injection attacks.
By using parameterized queries, the code ensures that user input is properly sanitized and escaped, eliminating the risk of SQL Injection vulnerabilities.
For more information on preventing SQL Injection vulnerabilities, you can refer to the following documentation:
Note
Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?
✨ Amplify has finished checking this pull request👍 Everything looks good! No issues detected in 📄 1 file and ❇️ 60 lines of code. Security Pipeline
Note For more details, visit Amplify Security. |
✨ Amplify has finished checking this pull request👍 Everything looks good! No issues detected in 📄 1 file and ❇️ 60 lines of code. Security Pipeline
Note For more details, visit Amplify Security. |
This reverts commit 772251a.
✨ Amplify has finished checking this pull requestSecurity Pipeline
Vulnerabilities Detected
Note For more details, visit Amplify Security. |
Description
A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.
Resolved or fixed issue:
Affirmation