Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Re-write order helper to mitigate potential SQL injections #142

Open
csucrab opened this issue Dec 29, 2016 · 1 comment
Open

Re-write order helper to mitigate potential SQL injections #142

csucrab opened this issue Dec 29, 2016 · 1 comment

Comments

@csucrab
Copy link

csucrab commented Dec 29, 2016

Hi, when our server which is made of mongo-sql was scaned by our security department, they told us there is some risk of sql injection. After checking the code of "order"(mongo-sql/helpers/query/order.js), I found that:

 10   for (var key in order){                                                       
 11     output += utils.quoteObject(key, query.__defaultTable) + ' ' + order[key] + ', ';
 12   }

I think meybey call escape funciton with key and order[key] is better here?

@jrf0110
Copy link
Member

jrf0110 commented Dec 29, 2016

Hi, @csucrab Thanks for bringing this up. There are actually a number of risks I'd like to mitigate, and this is one of them. If you can submit a PR, that'd be great! Otherwise, I'll get to this as soon as I can.

@jrf0110 jrf0110 changed the title "order" has the risk of sql injection Re-write order helper to mitigate potential SQL injections Dec 29, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants