[Local] Test after ENG-694 migration

[mwillfox]

Description

A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.

Resolved or fixed issue:

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[amplify-lab]

✨ Amplify has finished checking this pull request

⚠️ 2 issues detected in 📄 3 files and ❇️ 63 lines of code.

Security Pipeline

Tool	Configured	Result
Semgrep	✅	⚠️

Vulnerabilities Detected

Vulnerability	Path	Fingerprint
CWE-89	routes/search.ts:22	[eec4f3b0...]
CWE-89	routes/search.ts:22	[ed4aa726...]

Note

To ignore a finding, append @amplify-ignore in a comment to the end of the vulnerable line like // @amplify-ignore or # @amplify-ignore. For more details, visit Amplify Security.

[amplify-lab]

Warning

Amplify has been notified that this line contains a vulnerability 🕷️.

Vulnerability: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact: HIGH

Code Fix: ✅

Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`)
	.then(([products]: any) => {
	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` }, type: models.sequelize.QueryTypes.SELECT })
	.then((products: any) => {

The code change fixes the SQL Injection vulnerability by using parameterized queries instead of directly concatenating user input into the SQL query string.

In the original code, the user input criteria is directly concatenated into the SQL query using string interpolation (%${criteria}%). This allows an attacker to manipulate the criteria value and inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

In the updated code, the criteria value is passed as a parameter using the replacements option in the sequelize.query method. This ensures that the user input is properly sanitized and escaped before being included in the SQL query. By using parameterized queries, the code prevents SQL Injection attacks by treating the user input as data rather than executable code.

For more information on preventing SQL Injection vulnerabilities, you can refer to the OWASP SQL Injection Prevention Cheat Sheet: OWASP SQL Injection Prevention Cheat Sheet

Note

Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?

[amplify-lab]

Warning

Amplify has been notified that this line contains a vulnerability 🕷️.

Vulnerability: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impact: MEDIUM

Code Fix: ✅

Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`)
	.then(([products]: any) => {
	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE ? OR description LIKE ?) AND deletedAt IS NULL) ORDER BY name`, {
	replacements: [`%${criteria}%`, `%${criteria}%`],
	type: models.sequelize.QueryTypes.SELECT
	})
	.then((products: any) => {

The code change fixes the 'Cross-site Scripting' vulnerability by properly neutralizing the input during web page generation.

In the original code, the criteria variable is directly interpolated into the SQL query string without any sanitization or parameterization. This allows an attacker to inject malicious code into the query, leading to a potential XSS vulnerability.

The code change replaces the direct interpolation with parameterized queries using the replacements option. The ? placeholders in the query string are replaced with the sanitized criteria value. This ensures that the input is properly escaped and prevents any malicious code from being executed.

By using parameterized queries, the code change mitigates the risk of XSS attacks by ensuring that user input is treated as data rather than executable code.

For more information on preventing XSS vulnerabilities, you can refer to the OWASP XSS Prevention Cheat Sheet: OWASP XSS Prevention Cheat Sheet

Note

Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?

[amplify-local]

✨ Amplify has finished checking this pull request

⚠️ 2 issues detected in 📄 3 files and ❇️ 63 lines of code.

Security Pipeline

Tool	Configured	Result
Semgrep	✅	⚠️

Vulnerabilities Detected

Vulnerability	Path	Fingerprint
CWE-89	routes/search.ts:22	[eec4f3b0...]
CWE-89	routes/search.ts:22	[ed4aa726...]

Note

To ignore a finding, append @amplify-ignore in a comment to the end of the vulnerable line like // @amplify-ignore or # @amplify-ignore. For more details, visit Amplify Security.

[amplify-local]

Warning

Amplify has been notified that this line contains a vulnerability 🕷️.

Vulnerability: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact: HIGH

Code Fix: ✅

Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`)
	.then(([products]: any) => {
	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` }, type: models.sequelize.QueryTypes.SELECT })
	.then((products: any) => {

The code change fixes the SQL Injection vulnerability by using parameterized queries instead of directly concatenating user input into the SQL query string.

In the original code, the user input criteria is directly concatenated into the SQL query string using string interpolation (%${criteria}%). This allows an attacker to manipulate the criteria value and inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

In the updated code, the criteria value is passed as a parameter using the replacements option in the sequelize.query method. This ensures that the user input is properly sanitized and escaped before being included in the SQL query. By using parameterized queries, the code prevents SQL Injection attacks by treating the user input as data rather than executable code.

Here is the documentation for Sequelize's parameterized queries: Sequelize - Querying - Parameterized queries

Note

Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?

[amplify-local]

Warning

Amplify has been notified that this line contains a vulnerability 🕷️.

Vulnerability: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impact: MEDIUM

Code Fix: ✅

Amplify Security has prepared an automated remediation for review. Click here to review and commit the code fix.

Suggested change

	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE '%${criteria}%' OR description LIKE '%${criteria}%') AND deletedAt IS NULL) ORDER BY name`)
	.then(([products]: any) => {
	models.sequelize.query(`SELECT * FROM Products WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL) ORDER BY name`, { replacements: { criteria: `%${criteria}%` }, type: models.sequelize.QueryTypes.SELECT })
	.then((products: any) => {

The code change fixes the 'Cross-site Scripting' vulnerability by properly neutralizing the input during web page generation.

In the original code, the criteria variable is directly concatenated into the SQL query string using string interpolation (%${criteria}%). This can allow an attacker to inject malicious code into the query, leading to potential cross-site scripting attacks.

The code change replaces the string interpolation with parameterized queries. Instead of directly concatenating the criteria variable into the query string, it uses a placeholder (:criteria) and provides the actual value as a replacement using the replacements option. This ensures that the input is properly escaped and prevents any malicious code from being executed.

By using parameterized queries, the code change mitigates the risk of cross-site scripting vulnerabilities and improves the security of the application.

For more information on preventing cross-site scripting vulnerabilities, you can refer to the OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet: OWASP XSS Prevention Cheat Sheet

Note

Have a question or concern about this vulnerability fix? Get an answer within seconds by asking our Concierge 🤖 with @amplify-security.
i.e. @amplify-security are there known performance issues resulting from this fix?