Ccodemod

codemod/express-postgres-parameterized-queries

Transform Express handlers using pg.query() with string concatenation to parameterized queries

securitysql-injectionpostgresqlexpresstransformationmigration
Public
0 executions
Apply to Repository

Run locally

npx codemod @codemod/express-postgres-parameterized-queries

Express PostgreSQL Parameterized Queries

⚠️ Critical Security Fix: Transform PostgreSQL queries to use parameterized queries and prevent SQL injection vulnerabilities (CWE-89).

This codemod automatically transforms PostgreSQL queries in Express applications that use string concatenation or template literals into safe parameterized queries using the pg (node-postgres) library.

🔒 Security Impact

Vulnerability: CWE-89 - SQL Injection
OWASP: A03:2021 - Injection
Severity: Critical

SQL injection occurs when user input is directly concatenated into SQL query strings, allowing attackers to manipulate the query structure and potentially:

  • Access unauthorized data
  • Modify or delete database records
  • Execute administrative operations
  • Bypass authentication

🚀 Installation

bash

✨ Transformations

Template Literals → Parameterized Queries

Before:

javascript

After:

javascript

String Concatenation → Parameterized Queries

Before:

javascript

After:

javascript

Complex Multi-Parameter Queries

Before:

javascript

After:

javascript

DELETE and UPDATE Operations

Before:

javascript

After:

javascript

🎯 Scope

✅ Transforms

  • Files importing pg or node-postgres
  • Express route handlers and middleware
  • .query() method calls with:
    • Template literals containing variables (${variable})
    • String concatenation with + operator
    • Mixed quote styles and complex expressions

❌ Ignores

  • Already parameterized queries (using $1, $2 syntax)
  • Static queries without dynamic content
  • Query builders (Knex, Sequelize, Prisma)
  • Test files (*.test.*, *.spec.*)
  • Database migration files
  • Comments and documentation

🔧 Usage Examples

Express Route Handler

javascript

Middleware Function

javascript

🔍 Why This Matters

Vulnerable Code Example

javascript

Secure Code After Transformation

javascript

🏗️ Development

bash

📚 References

📄 License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community