Express SQL Injection to Parameterized Queries
Security Codemod for CWE-89: SQL Injection Prevention
Transform SQL queries using string concatenation or template literals with user input to secure parameterized queries with placeholders. This codemod helps prevent SQL injection vulnerabilities by converting vulnerable query patterns into safe parameterized queries.
Security Impact
- Prevents: SQL Injection attacks (CWE-89)
- Scope: Express.js applications with direct SQL query construction
- Risk Level: High - SQL injection can lead to data theft, unauthorized access, and data corruption
Installation
What it transforms
String Concatenation with User Input
Before:
After:
Template Literals with User Input
Before:
After:
Multiple Parameters
Before:
After:
Detection Scope
This codemod identifies and transforms:
- String concatenation using
+operator with Express request objects (req.params,req.query,req.body) - Template literals using
${}substitution with user input - Database method calls including
query(),execute(),run(),prepare(),all(),get() - Multiple parameter patterns in a single query
What it doesn't transform
- Already parameterized queries using
?or$1,$2placeholders - Static SQL queries without user input concatenation
- Non-SQL string concatenation
- Configuration files with connection strings
- Test files and mock queries
Supported Database Libraries
Works with popular Node.js database libraries:
mysql/mysql2pg(PostgreSQL)sqlite3mariadb- Any library using standard
query(),execute(),run()methods
Security References
Development
License
MIT
Contributing
This codemod is part of the Arc Security Codemods collection. Issues and contributions are welcome at the main repository.