caritas/nestjs-paginate
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: bind ilike/like parameters to prevent sql injection (#465)

Browse Source
This commit is contained in:
Jacques Germishuys 2023-01-30 08:19:15 +00:00 committed by GitHub
parent 13d0a1350a
commit ff00785cd1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/paginate.spec.ts
View File

@ -415,6 +415,21 @@ describe('paginate', () => {
expect(result.links.current).toBe('?page=1&limit=20&sortBy=id:ASC&search=i') expect(result.links.current).toBe('?page=1&limit=20&sortBy=id:ASC&search=i')
}) })
it('should not result in a sql syntax error when attempting a sql injection', async () => {
const config: PaginateConfig<CatEntity> = {
sortableColumns: ['id', 'name', 'color'],
searchableColumns: ['name', 'color'],
}
const query: PaginateQuery = {
path: '',
search: "i UNION SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'",
}
const result = await paginate<CatEntity>(query, catRepo, config)
expect(result.data).toStrictEqual([])
})
it('should return result based on search term on many-to-one relation', async () => { it('should return result based on search term on many-to-one relation', async () => {
const config: PaginateConfig<CatToyEntity> = { const config: PaginateConfig<CatToyEntity> = {
relations: ['cat'], relations: ['cat'],

4
src/paginate.ts
View File

@ -311,10 +311,10 @@ export async function paginate<T extends ObjectLiteral>(
} }
const aliasColumn = alias + columns.substring(0, columns.length - 1) const aliasColumn = alias + columns.substring(0, columns.length - 1)
qb.orWhere(`${aliasColumn}::text ILIKE '%${query.search}%'`) qb.orWhere(`${aliasColumn}::text ILIKE(:search)`, { search: `%${query.search}%` })
} else { } else {
const aliasColumn = hasRelation ? `${qb.alias}_${column}` : `${qb.alias}.${column}` const aliasColumn = hasRelation ? `${qb.alias}_${column}` : `${qb.alias}.${column}`
qb.orWhere(`UPPER(${aliasColumn}) LIKE UPPER('%${query.search}%')`) qb.orWhere(`UPPER(${aliasColumn}) LIKE UPPER(:search)`, { search: `%${query.search}%` })
} }
} }
}) })