drizzle-team / drizzle-team/drizzle-orm
[BUG]: Relational queries v2 skipping `undefined` values can lead to security vulnerabilities
- Dominant language
- TypeScript
- Stars
- 35.8k
- Forks
- 1.6k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 4
Description
### Report hasn't been filed before.
- [x] I have verified that the bug I'm about to report hasn't been filed before.
### What version of `drizzle-orm` are you using?
1.0.0-beta.21
### What version of `drizzle-kit` are you using?
1.0.0-beta.21
### Other packages
_No response_
### Describe the Bug
Consider the following code:
```ts
const session = await db.query.sessions.findFirst({
where: {
token,
},
});
```
or
```ts
const session = await db.query.sessions.findFirst({
where: {
token: { eq: token },
},
});
```
Both of these examples will return a *random* session when `token` is `undefined`, in my example due to bad type information. Drizzle is skipping fields with `undefined` as their value.
This a great way to introduce security vulnerabilities into apps, in my case unauthenticated users would be automatically recognized as admins because admin was the first user in that table.
I think there's a big potential for data leaks if users find a way to sneak `undefined` into filters somehow, whether intentionally or by accident.
I don't think drizzle should be skipping fields when applying filters, I don't think providing `undefined` should be a valid option at all, if that's intentional I think it should be documented that relational queries are unsafe with untrusted input.
Contributor guide
Assessment
This issue has not been assessed yet.