Security Codemod for CWE-89: SQL Injection Prevention
Transform SQL queries using string concatenation or template literals with user input to secure parameterized queries with placeholders. This codemod helps prevent SQL injection vulnerabilities by converting vulnerable query patterns into safe parameterized queries.
Security Impact
Prevents: SQL Injection attacks (CWE-89)
Scope: Express.js applications with direct SQL query construction
Risk Level: High - SQL injection can lead to data theft, unauthorized access, and data corruption
Installation
bash
# Run directly from registry
npx codemod@latest run @codemod/express-sql-injection-parameterized-queries
# Or install and run locally
npm install -g @codemod/express-sql-injection-parameterized-queries
codemod run -w workflow.yaml
What it transforms
String Concatenation with User Input
Before:
javascript
app.get('/user/:id', (req, res) => {
const query = 'SELECT * FROM users WHERE id = ' + req.params.id;
db.query(query, (err, results) => {
res.json(results);
});
});
After:
javascript
app.get('/user/:id', (req, res) => {
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [req.params.id], (err, results) => {
res.json(results);
});
});
Template Literals with User Input
Before:
javascript
app.get('/search', (req, res) => {
const sql = `SELECT * FROM products WHERE name LIKE '%${req.query.search}%'`;
connection.execute(sql);
});
After:
javascript
app.get('/search', (req, res) => {
const sql = 'SELECT * FROM products WHERE name LIKE ?';
connection.execute(sql, [`%${req.query.search}%`]);
});
Multiple Parameters
Before:
javascript
db.query('DELETE FROM posts WHERE user_id = ' + req.body.userId + ' AND status = ' + req.body.status);
After:
javascript
db.query('DELETE FROM posts WHERE user_id = ? AND status = ?', [req.body.userId, req.body.status]);
Detection Scope
This codemod identifies and transforms:
String concatenation using + operator with Express request objects (req.params, req.query, req.body)
Template literals using ${} substitution with user input
Database method calls including query(), execute(), run(), prepare(), all(), get()
Multiple parameter patterns in a single query
What it doesn't transform
Already parameterized queries using ? or $1, $2 placeholders
Static SQL queries without user input concatenation
Non-SQL string concatenation
Configuration files with connection strings
Test files and mock queries
Supported Database Libraries
Works with popular Node.js database libraries:
mysql / mysql2
pg (PostgreSQL)
sqlite3
mariadb
Any library using standard query(), execute(), run() methods
# Test the transformation
pnpm test
# Run on specific files
npx codemod jssg run --language typescript ./scripts/codemod.ts -t your-file.js
# Update test snapshots
pnpm test -u
License
MIT
Contributing
This codemod is part of the Arc Security Codemods collection. Issues and contributions are welcome at the main repository.
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.