commercetools / commercetools/nodejs
Sanitize user input to prevent SQL injections
- Dominant language
- JavaScript
- Stars
- 77
- Forks
- 70
- PR merge metrics
- No merged PRs in 30d
Description
### Description
It would be great if we have a sanitize() function fo user input tool to prevent SQL injection. Consider this code
```js
{
"anonymousId": some_user_input,
"email": "abc@email.com"
}
```
if user sends SQL injection some_user_input= "0\" or something=1 or anonymousId=\"0", then the result will be
```js
{
"anonymousId": "0\" or something=1 or anonymousId=\"0",
"email": "abc@email.com"
}
```
and the error output will contain secure information about all available fields.
### Expected Behavior
empty result as there is no such anonymous id "0\" or something=1 or anonymousId=\"0"
### Current Behavior
and the output will contain secure information about all available fields.
### Context
This is classical SQL injection which possibly appears in every user controller where controller expects user input
### Possible Solution
Provide sanitize() function which prevent SQL injections
Contributor guide
Assessment
This issue has not been assessed yet.