fixes pg.js SQL injection vulnerablity

database/postgres/pg.js

@@ -23,23 +23,23 @@ pgModule.closePGDB = ()=>{
 pgModule.createPgAccount = async (username, password)=>{
     if(!username || !password) return
   try{
-    await client.query(`CREATE DATABASE IF NOT EXISTS ${username}`)
-    await client.query(`CREATE USER IF NOT EXISTS ${username} WITH ENCRYPTED password '${password}'`)
-    await client.query(`GRANT ALL PRIVILEGES ON DATABASE ${username} TO ${username}`)
+    await client.query(`CREATE DATABASE IF NOT EXISTS $1`, [username])
+    await client.query(`CREATE USER IF NOT EXISTS $1 WITH ENCRYPTED password $2`, [username, password])
+    await client.query(`GRANT ALL PRIVILEGES ON DATABASE $1 TO $1`, [username])
   }catch(err){
     logger.error(err)
-    throw new Error(`failed to createPgAccount for user: ${username}`)
+    throw new Error(`failed to createPgAccount for user: $1`, [username])
   }
 }
 
 pgModule.deletePgAccount = async (username)=>{
     if(!username) return
   try{
-    await client.query(`DROP DATABASE IF EXISTS ${username}`)
-    await client.query(`DROP USER IF EXISTS ${username}`)
+    await client.query(`DROP DATABASE IF EXISTS $1`, [username])
+    await client.query(`DROP USER IF EXISTS $1`, [username])
   }catch(err){
     logger.error(err)
-    throw new Error(`failed to deletePgAccount for database and user: ${username}`)
+    throw new Error(`failed to deletePgAccount for database and user: $1`, [username])
   }
 }
 

database/postgres/pg.test.js

@@ -1,3 +1,8 @@
+jest.mock('../../lib/log')
+const logGen = require('../../lib/log')
+const logger = {error: jest.fn()}
+logGen.mockReturnValue(logger)
+
 jest.mock('pg')
 const {Client} = require('pg')
 const {startPGDB, closePGDB, createPgAccount, deletePgAccount} = require('./pg')
@@ -35,22 +40,21 @@ describe('Test PG DB', ()=>{
       it('it should execute all queries if required arguments are passed into createPgAccount', async ()=>{
         await createPgAccount('username', 'password')
         expect(mockClient.query).toHaveBeenCalledTimes(3)
-        expect(mockClient.query).toHaveBeenNthCalledWith(1, `CREATE DATABASE IF NOT EXISTS username`)
-        expect(mockClient.query).toHaveBeenNthCalledWith(2, `CREATE USER IF NOT EXISTS username WITH ENCRYPTED password 'password'`)
-        expect(mockClient.query).toHaveBeenNthCalledWith(3, `GRANT ALL PRIVILEGES ON DATABASE username TO username`)
+        expect(mockClient.query.mock.calls[0]).toEqual([`CREATE DATABASE IF NOT EXISTS $1`, ['username']])
+        expect(mockClient.query.mock.calls[1]).toEqual([`CREATE USER IF NOT EXISTS $1 WITH ENCRYPTED password $2`, ['username', 'password']])
+        expect(mockClient.query.mock.calls[2]).toEqual([`GRANT ALL PRIVILEGES ON DATABASE $1 TO $1`, ['username']])
       })
       it('it should not execute any queries in createPgAccount if required arguments are not passed in', async ()=>{
         await createPgAccount()
         expect(mockClient.query).toHaveBeenCalledTimes(0)
       })
-      it('it should check if console.log is called at throw of createPgAccount', async ()=>{
+      it('it should check if logger.error is called at throw of createPgAccount', async ()=>{
         try{
-          console.log = jest.fn() 
           await mockClient.query.mockReturnValue(Promise.reject())
           const resCreatePgAccount = await createPgAccount('username', 'password')
           expect(resCreatePgAccount).rejects.toThrow()
         }catch(err){
-          expect(console.log).toHaveBeenCalledTimes(1)
+          expect(logger.error).toHaveBeenCalledTimes(1)
         }
       })
     })
@@ -59,23 +63,22 @@ describe('Test PG DB', ()=>{
         mockClient.query.mockReturnValue(Promise.resolve())
         await deletePgAccount('username')
         expect(mockClient.query).toHaveBeenCalledTimes(2)
-        expect(mockClient.query).toHaveBeenNthCalledWith(1, `DROP DATABASE IF EXISTS username`)
-        expect(mockClient.query).toHaveBeenNthCalledWith(2, `DROP USER IF EXISTS username`)
+        expect(mockClient.query.mock.calls[0]).toEqual([`DROP DATABASE IF EXISTS $1`, ['username']])
+        expect(mockClient.query.mock.calls[1]).toEqual([`DROP USER IF EXISTS $1`, ['username']])
       })
       it('it should not execute any queries in deletePgAccount if required arguments are not passed in', async ()=>{
         await deletePgAccount()
         expect(mockClient.query).toHaveBeenCalledTimes(0)
       })
-      it('it should check if console.log is called at throw of deletePgAccount', async ()=>{
+      it('it should check if logger.error is called at throw of deletePgAccount', async ()=>{
         try{
-          console.log = jest.fn() 
           await mockClient.query.mockReturnValue(Promise.reject())
           const resDeletePgAccount = await deletePgAccount('username', 'password')
           expect(resDeletePgAccount).rejects.toThrow()
         }catch(err){
-          expect(console.log).toHaveBeenCalledTimes(1)
+          expect(logger.error).toHaveBeenCalledTimes(1)
         }
       })
     })
   })
-})
+})