Secure Knex Connection Strings

A security-focused codemod that identifies and replaces hardcoded credentials in Knex.js connection configurations with environment variable references, following security best practices and preventing credential leaks in version control.

Security Issue

CWE-798: Use of Hard-coded Credentials
OWASP A07:2021 - Identification and Authentication Failures

Connection strings with embedded credentials in Knex configurations expose database secrets in source code, violating security best practices and potentially leading to credential leaks in version control systems.

Installation

bash
Copy
# Run directly via Codemod CLI
npx codemod secure-knex-connection-strings

# Or install and run locally  
npx codemod init secure-knex-connection-strings
npm install
npm test

What it transforms

Connection Strings

Before:

javascript
Copy
const config = {
  client: 'postgresql',
  connection: 'postgres://user:password@prod-db.com:5432/myapp'
};

After:

javascript
Copy
const config = {
  client: 'postgresql', 
  connection: process.env.DATABASE_URL
};

Localhost Connection Strings (with fallback)

Before:

javascript
Copy
const config = {
  client: 'pg',
  connection: 'postgres://user:password@localhost:5432/mydb'
};

After:

javascript
Copy
const config = {
  client: 'pg',
  connection: process.env.DATABASE_URL || 'postgres://user:password@localhost:5432/mydb'
};

Object-style Connection Configuration

Before:

javascript
Copy
const config = {
  client: 'mysql2',
  connection: {
    host: 'prod-db.example.com',
    user: 'admin', 
    password: 'secret123',
    database: 'production'
  }
};

After:

javascript
Copy
const config = {
  client: 'mysql2',
  connection: {
    host: process.env.DB_HOST || 'localhost',
    user: process.env.DB_USER || 'admin',
    password: process.env.DB_PASSWORD,
    database: process.env.DB_NAME || 'production'
  }
};

What it doesn't transform

• Connections already using environment variables (process.env.*)
• Localhost connections with common test credentials (postgres:postgres, root:root)
• Placeholder values (username, your_password)
• SQLite file-based connections (no network credentials)
• Template literals already using environment variables

Supported File Types

• JavaScript (.js)
• TypeScript (.ts)
• Configuration files (.json)
• Knex files (knexfile.*, *config*)

Environment Variables Used

• DATABASE_URL - Complete connection string
• DB_HOST - Database host
• DB_USER - Username
• DB_PASSWORD - Password (no fallback for security)
• DB_NAME - Database name
• DB_PORT - Port number

Development

bash
Copy
# Run tests
pnpm test

# Run on specific directory
npx codemod jssg run --language typescript ./scripts/codemod.ts --target /path/to/code

# Test single case  
npx codemod jssg test -l typescript ./scripts/codemod.ts --filter postgres-connection-string

Security References

• CWE-798: Use of Hard-coded Credentials
• OWASP Top 10 2021 - A07: Identification and Authentication Failures
• Knex.js Documentation - Configuration Options

License

MIT