drizzle-team / drizzle-team/drizzle-orm

[BUG]: Relational queries v2 skipping `undefined` values can lead to security vulnerabilities

Open
#5,636 3 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
35.8k
Forks
1.6k
Avg merge
2d 7h
Merged PRs (30d)
4

Description

### Report hasn't been filed before.

- [x] I have verified that the bug I'm about to report hasn't been filed before.

### What version of `drizzle-orm` are you using?

1.0.0-beta.21

### What version of `drizzle-kit` are you using?

1.0.0-beta.21

### Other packages

_No response_

### Describe the Bug

Consider the following code:

```ts
const session = await db.query.sessions.findFirst({
where: {
token,
},
});
```

or

```ts
const session = await db.query.sessions.findFirst({
where: {
token: { eq: token },
},
});
```

Both of these examples will return a *random* session when `token` is `undefined`, in my example due to bad type information. Drizzle is skipping fields with `undefined` as their value.

This a great way to introduce security vulnerabilities into apps, in my case unauthenticated users would be automatically recognized as admins because admin was the first user in that table.
I think there's a big potential for data leaks if users find a way to sneak `undefined` into filters somehow, whether intentionally or by accident.

I don't think drizzle should be skipping fields when applying filters, I don't think providing `undefined` should be a valid option at all, if that's intentional I think it should be documented that relational queries are unsafe with untrusted input.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.