Skip to content
This repository

Warning: Security Issues with Query-Type-Escaping and Express #501

Closed
denisu opened this Issue · 0 comments

1 participant

Dennis
Dennis
denisu commented

Hi,

if you are using Express and the Express query parser, you might be doing something like GET /users?id=xxx

And in your app:

db.query('SELECT * FROM users WHERE id = ?', [req.query.id])

I have seen this several times now, this is very dangerous! The Express query parser is translating arrays and objects, which node-mysql loves to translate as well.

So, an attacker could do GET /users?id[id]=1 which Express translates to {"id":"1"} which ends up as

SELECT * FROM users WHERE id = `id` = '1'

I understand that this might not be an issue with node-mysql, but it would be great to have an option to turn off the automatic type translation in node-mysql, maybe even by default, since most people are not expecting the escaper to behave like that.

Christian Tellnes tellnes referenced this issue from a commit in tellnes/node-mysql
Christian Tellnes tellnes add `stringifyObjects` option
fixes #501
dd921c3
Felix Geisendörfer felixge closed this in #502
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.