Secure Knex Connection Strings
A security-focused codemod that identifies and replaces hardcoded credentials in Knex.js connection configurations with environment variable references, following security best practices and preventing credential leaks in version control.
Security Issue
CWE-798: Use of Hard-coded Credentials
OWASP A07:2021 - Identification and Authentication Failures
Connection strings with embedded credentials in Knex configurations expose database secrets in source code, violating security best practices and potentially leading to credential leaks in version control systems.
Installation
What it transforms
Connection Strings
Before:
After:
Localhost Connection Strings (with fallback)
Before:
After:
Object-style Connection Configuration
Before:
After:
What it doesn't transform
- Connections already using environment variables (
process.env.*) - Localhost connections with common test credentials (
postgres:postgres,root:root) - Placeholder values (
username,your_password) - SQLite file-based connections (no network credentials)
- Template literals already using environment variables
Supported File Types
- JavaScript (
.js) - TypeScript (
.ts) - Configuration files (
.json) - Knex files (
knexfile.*,*config*)
Environment Variables Used
DATABASE_URL- Complete connection stringDB_HOST- Database hostDB_USER- UsernameDB_PASSWORD- Password (no fallback for security)DB_NAME- Database nameDB_PORT- Port number
Development
Security References
- CWE-798: Use of Hard-coded Credentials
- OWASP Top 10 2021 - A07: Identification and Authentication Failures
- Knex.js Documentation - Configuration Options
License
MIT