@codemod/fix-sequelize-empty-password-args
Security Fix: Detects Sequelize instances with empty password arguments and replaces them with environment variable references to prevent authentication bypass vulnerabilities.
Overview
Sequelize connections with empty password arguments (empty strings, null, or undefined) pose significant security risks by potentially allowing unauthorized database access. This codemod identifies such instances and automatically replaces them with secure environment variable references.
Security Impact
This codemod addresses:
- CWE-287: Improper Authentication - Empty passwords can bypass authentication mechanisms
- OWASP A6: Security Misconfiguration - Improper database authentication setup
- Authentication Bypass: Prevents unauthorized database access through empty credentials
Installation
Transformations
Before/After Examples
Positional Arguments
Object Configuration
What Gets Transformed
✅ Transforms:
new Sequelize('db', 'user', '')new Sequelize('db', 'user', null)new Sequelize('db', 'user', undefined)new Sequelize({ password: '' })new Sequelize({ password: null })
❌ Doesn't Transform:
new Sequelize('db', 'user', 'actualpassword')(already secure)new Sequelize('db', 'user', process.env.DB_PASSWORD)(already using env vars)- Files without Sequelize imports
- Commented code
Requirements
- Files must import Sequelize from the 'sequelize' package
- Supports both default imports (
import Sequelize from 'sequelize') and named imports (import { Sequelize } from 'sequelize') - Works with JavaScript, TypeScript, JSX, and TSX files
Post-Transformation Steps
After running this codemod:
-
Set Environment Variable: Ensure
DB_PASSWORDis set in your environment:bash -
Update Environment Files: Add to your
.envfile:text -
Review Changes: Verify all transformations are correct
-
Test Database Connections: Ensure your application still connects properly
Development
References
- CWE-287: Improper Authentication
- OWASP A6: Security Misconfiguration
- Sequelize Authentication Documentation
- OWASP Database Security Cheat Sheet
License
MIT