commercetools / commercetools/nodejs

Sanitize user input to prevent SQL injections

Open
#1,889 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
77
Forks
70
PR merge metrics
No merged PRs in 30d

Description

### Description

It would be great if we have a sanitize() function fo user input tool to prevent SQL injection. Consider this code

```js
{
"anonymousId": some_user_input,
"email": "abc@email.com"
}
```

if user sends SQL injection some_user_input= "0\" or something=1 or anonymousId=\"0", then the result will be

```js
{
"anonymousId": "0\" or something=1 or anonymousId=\"0",
"email": "abc@email.com"
}
```

and the error output will contain secure information about all available fields.

### Expected Behavior

empty result as there is no such anonymous id "0\" or something=1 or anonymousId=\"0"

### Current Behavior

and the output will contain secure information about all available fields.

### Context

This is classical SQL injection which possibly appears in every user controller where controller expects user input

### Possible Solution

Provide sanitize() function which prevent SQL injections

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.