feat: detect identifier sql-injection (#501)

clemgbld · web-flow · commit 1c2c39fecc9a · 2026-01-29T16:16:19.000+01:00
diff --git a/.changeset/sunny-moments-jam.md b/.changeset/sunny-moments-jam.md
@@ -0,0 +1,7 @@
+---
+"@nodesecure/tracer": major
+"@nodesecure/estree-ast-utils": minor
+"@nodesecure/js-x-ray": minor
+---
+
+feat: detect identifier sql-injection
diff --git a/workspaces/estree-ast-utils/src/getCallExpressionArguments.ts b/workspaces/estree-ast-utils/src/getCallExpressionArguments.ts
@@ -4,6 +4,7 @@ import type { ESTree } from "meriyah";
 
 // Import Internal Dependencies
 import { concatBinaryExpression } from "./concatBinaryExpression.ts";
+import { toLiteral } from "./toLiteral.ts";
 import {
   type DefaultOptions,
   noop
@@ -42,6 +43,12 @@ export function getCallExpressionArguments(
 
         break;
       }
+      case "TemplateLiteral": {
+        const literal = toLiteral(arg);
+        literalsNode.push(literal);
+
+        break;
+      }
       case "BinaryExpression": {
         const concatenatedBinaryExpr = [
           ...concatBinaryExpression(arg, { externalIdentifierLookup })
diff --git a/workspaces/estree-ast-utils/src/index.ts b/workspaces/estree-ast-utils/src/index.ts
@@ -7,4 +7,5 @@ export * from "./getMemberExpressionIdentifier.ts";
 export * from "./getVariableDeclarationIdentifiers.ts";
 export type { DefaultOptions } from "./options.ts";
 export * from "./utils/is.ts";
+export * from "./toLiteral.ts";
 
diff --git a/workspaces/estree-ast-utils/src/toLiteral.ts b/workspaces/estree-ast-utils/src/toLiteral.ts
@@ -4,3 +4,4 @@ import type { ESTree } from "meriyah";
 export function toLiteral(templateLiteral: ESTree.TemplateLiteral) {
   return templateLiteral.quasis.map(({ tail, value: { raw } }, i) => (tail ? raw : `${raw}\${${i}}`)).join("");
 }
+
diff --git a/workspaces/estree-ast-utils/test/getCallExpressionArguments.spec.ts b/workspaces/estree-ast-utils/test/getCallExpressionArguments.spec.ts
@@ -60,4 +60,15 @@ describe("getCallExpressionArguments", () => {
 
     assert.deepEqual(args, ["hello world"]);
   });
+
+  test("resolve the TemplateLiteral and return is Literal value", () => {
+    /* eslint-disable-next-line no-template-curly-in-string */
+    const [astNode] = codeToAst("foo(`hello ${name}`);");
+    const args = getCallExpressionArguments(
+      getExpressionFromStatement(astNode)
+    );
+
+    /* eslint-disable-next-line no-template-curly-in-string */
+    assert.deepEqual(args, ["hello ${0}"]);
+  });
 });
diff --git a/workspaces/estree-ast-utils/test/toLiteral.spec.ts b/workspaces/estree-ast-utils/test/toLiteral.spec.ts
@@ -3,7 +3,7 @@ import assert from "node:assert";
 import { describe, it } from "node:test";
 
 // Import Internal Dependencies
-import { toLiteral } from "../../src/utils/toLiteral.ts";
+import { toLiteral } from "../src/toLiteral.ts";
 
 describe("toLiteral", () => {
   it("should transform a TemplateLiteral to a literal", () => {
@@ -93,3 +93,4 @@ describe("toLiteral", () => {
     }), `hello \${${0}} world \${${1}} `);
   });
 });
+
diff --git a/workspaces/js-x-ray/src/ProbeRunner.ts b/workspaces/js-x-ray/src/ProbeRunner.ts
@@ -229,7 +229,7 @@ export class ProbeRunner {
 
     if (node.type === "CallExpression") {
       const id = getCallExpressionIdentifier(node, {
-        externalIdentifierLookup: (name) => this.sourceFile.tracer.literalIdentifiers.get(name) ?? null
+        externalIdentifierLookup: (name) => this.sourceFile.tracer.literalIdentifiers.get(name)?.value ?? null
       });
       if (id !== null) {
         tracedIdentifierReport = this.sourceFile.tracer.getDataFromIdentifier(id);
diff --git a/workspaces/js-x-ray/src/probes/isMonkeyPatch.ts b/workspaces/js-x-ray/src/probes/isMonkeyPatch.ts
@@ -104,7 +104,7 @@ function validateMemberExpression(
   ctx: ProbeContext
 ): [boolean, any?] {
   const iter = getMemberExpressionIdentifier(node, {
-    externalIdentifierLookup: (name: string) => ctx.sourceFile.tracer.literalIdentifiers.get(name) ?? null
+    externalIdentifierLookup: (name: string) => ctx.sourceFile.tracer.literalIdentifiers.get(name)?.value ?? null
   });
 
   const jsTypeName = iter.next().value;
diff --git a/workspaces/js-x-ray/src/probes/isRequire/RequireCallExpressionWalker.ts b/workspaces/js-x-ray/src/probes/isRequire/RequireCallExpressionWalker.ts
@@ -95,7 +95,7 @@ export class RequireCallExpressionWalker {
     const nodeArguments = getCallExpressionArguments(
       node,
       {
-        externalIdentifierLookup: (name) => this.tracer.literalIdentifiers.get(name) ?? null
+        externalIdentifierLookup: (name) => this.tracer.literalIdentifiers.get(name)?.value ?? null
       }
     );
 
diff --git a/workspaces/js-x-ray/src/probes/isRequire/isRequire.ts b/workspaces/js-x-ray/src/probes/isRequire/isRequire.ts
@@ -93,7 +93,7 @@ function main(
     case "Identifier":
       if (sourceFile.tracer.literalIdentifiers.has(arg.name)) {
         sourceFile.addDependency(
-          sourceFile.tracer.literalIdentifiers.get(arg.name)!,
+          sourceFile.tracer.literalIdentifiers.get(arg.name)?.value!,
           node.loc
         );
       }
@@ -115,7 +115,7 @@ function main(
     case "ArrayExpression": {
       const value = [
         ...arrayExpressionToString(arg, {
-          externalIdentifierLookup: (name) => tracer.literalIdentifiers.get(name) ?? null
+          externalIdentifierLookup: (name) => tracer.literalIdentifiers.get(name)?.value ?? null
         })
       ]
         .join("")
@@ -143,7 +143,7 @@ function main(
 
       try {
         const iter = concatBinaryExpression(arg, {
-          externalIdentifierLookup: (name) => tracer.literalIdentifiers.get(name) ?? null,
+          externalIdentifierLookup: (name) => tracer.literalIdentifiers.get(name)?.value ?? null,
           stopOnUnsupportedNode: true
         });
 
diff --git a/workspaces/js-x-ray/src/probes/isUnsafeCommand.ts b/workspaces/js-x-ray/src/probes/isUnsafeCommand.ts
@@ -1,5 +1,6 @@
 // Import Third-party Dependencies
 import type { ESTree } from "meriyah";
+import { toLiteral } from "@nodesecure/estree-ast-utils";
 
 // Import Internal Dependencies
 import type {
@@ -12,7 +13,6 @@ import {
   isTemplateLiteral
 } from "../types/estree.ts";
 import { generateWarning } from "../warnings.ts";
-import { toLiteral } from "../utils/toLiteral.ts";
 
 // CONSTANTS
 const kUnsafeCommands = ["csrutil", "uname", "ping", "curl"];
diff --git a/workspaces/js-x-ray/src/probes/sql-injection.ts b/workspaces/js-x-ray/src/probes/sql-injection.ts
@@ -1,29 +1,50 @@
 // Import Third-party Dependencies
 import type { ESTree } from "meriyah";
+import { toLiteral } from "@nodesecure/estree-ast-utils";
 
 // Import Internal Dependencies
-import type { ProbeMainContext } from "../ProbeRunner.ts";
-import { toLiteral } from "../utils/toLiteral.ts";
+import type { ProbeMainContext, ProbeContext } from "../ProbeRunner.ts";
 import { generateWarning } from "../warnings.ts";
 
 // CONSTANTS
 const kSqlInjectionRegex = /(select\s+.*\s+from|insert\s+into|delete\s+from|update\s+.*\s+set)/i;
 
 function validateNode(
-  node: ESTree.Node
+  node: ESTree.Node,
+  { sourceFile: { tracer } }: ProbeContext
 ): [boolean, any?] {
   if (node.type !== "CallExpression") {
     return [false];
   }
 
   for (const argNode of node.arguments) {
-    if (argNode.type !== "TemplateLiteral" || argNode.expressions.length === 0) {
-      continue;
-    }
+    switch (argNode.type) {
+      case "Identifier": {
+        if (!tracer.literalIdentifiers.has(argNode.name)) {
+          break;
+        }
+
+        const literalIdentifier = tracer.literalIdentifiers.get(argNode.name);
+
+        if (literalIdentifier!.type !== "TemplateLiteral" ||
+          !kSqlInjectionRegex.test(literalIdentifier!.value)) {
+          break;
+        }
+
+        return [true, tracer.literalIdentifiers.get(argNode.name)?.value];
+      }
+
+      case "TemplateLiteral": {
+        if (argNode.expressions.length === 0) {
+          break;
+        }
+        const literal = toLiteral(argNode);
+        if (!kSqlInjectionRegex.test(literal)) {
+          break;
+        }
 
-    const literal = toLiteral(argNode);
-    if (kSqlInjectionRegex.test(literal)) {
-      return [true, literal];
+        return [true, literal];
+      }
     }
   }
 
diff --git a/workspaces/js-x-ray/test/probes/sql-injection.spec.ts b/workspaces/js-x-ray/test/probes/sql-injection.spec.ts
@@ -27,6 +27,34 @@ describe("sql-injection", () => {
     });
   });
 
+  test("should detect sql injection assigned in a variable", () => {
+    const query = "`SELECT * FROM users WHERE id = ${userId}`";
+    const code = `const userId = req.query.id;
+                  const query = ${query};
+                  db.query(query);`;
+
+    const { warnings: outputWarnings } = new AstAnalyser().analyse(code);
+    assert.strictEqual(outputWarnings.length, 1);
+    assert.deepEqual(outputWarnings[0].kind, "sql-injection");
+    assert.strictEqual(outputWarnings[0].value, query.replace(/\$\{[^}]*\}/, "${0}").replace(/`/g, ""));
+  });
+
+  test("should not detect sql injection when the query is not a TemplateLiteral in variable", () => {
+    const code = `const query = "SELECT * FROM users WHERE id = 1";
+                  db.query(query);`;
+
+    const { warnings: outputWarnings } = new AstAnalyser().analyse(code);
+    assert.strictEqual(outputWarnings.length, 0);
+  });
+
+  test("should not detect sql injection when the variable is not an sql query", () => {
+    const code = `const query = \`hello \${name}\`;
+                  db.query(query);`;
+
+    const { warnings: outputWarnings } = new AstAnalyser().analyse(code);
+    assert.strictEqual(outputWarnings.length, 0);
+  });
+
   test("should be case insensitive", () => {
     const queries = [
       "`SeLEcT * FRoM users wHERe eMail = ${email}`",
diff --git a/workspaces/tracer/src/VariableTracer.ts b/workspaces/tracer/src/VariableTracer.ts
@@ -8,9 +8,10 @@ import {
   getCallExpressionIdentifier,
   getMemberExpressionIdentifier,
   getVariableDeclarationIdentifiers,
-  isLiteral
+  isLiteral,
+  toLiteral
 } from "@nodesecure/estree-ast-utils";
-import type { ESTree } from "meriyah";
+import { type ESTree } from "meriyah";
 import { match } from "ts-pattern";
 
 // Import Internal Dependencies
@@ -84,12 +85,17 @@ export interface ImportEventPayload {
   location: ESTree.SourceLocation | null | undefined;
 }
 
+export interface LiteralIdentifier {
+  value: string;
+  type: "Literal" | "TemplateLiteral";
+}
+
 export class VariableTracer extends EventEmitter {
   static AssignmentEvent = Symbol("AssignmentEvent");
   static ImportEvent = Symbol("ImportEvent");
 
   // PUBLIC PROPERTIES
-  literalIdentifiers = new Map<string, string>();
+  literalIdentifiers = new Map<string, LiteralIdentifier>();
   importedModules = new Set<string>();
 
   // PRIVATE PROPERTIES
@@ -299,7 +305,7 @@ export class VariableTracer extends EventEmitter {
     const callExprArguments = getCallExpressionArguments(
       node,
       {
-        externalIdentifierLookup: (name) => this.literalIdentifiers.get(name) ?? null
+        externalIdentifierLookup: (name) => this.literalIdentifiers.get(name)?.value ?? null
       }
     );
     if (callExprArguments === null) {
@@ -310,7 +316,10 @@ export class VariableTracer extends EventEmitter {
     if (typeof callExprArgumentNode === "string") {
       this.literalIdentifiers.set(
         id.name,
-        Buffer.from(callExprArgumentNode, "base64").toString()
+        {
+          value: Buffer.from(callExprArgumentNode, "base64").toString(),
+          type: "Literal"
+        }
       );
     }
   }
@@ -401,7 +410,18 @@ export class VariableTracer extends EventEmitter {
     switch (childNode.type) {
       // let foo = "10"; <-- "foo" is the key and "10" the value
       case "Literal": {
-        this.literalIdentifiers.set(id.name, String(childNode.value));
+        this.literalIdentifiers.set(id.name, {
+          value: String(childNode.value),
+          type: childNode.type
+        });
+        break;
+      }
+      // const x = `hello ${name}`; "x" is the key and "hello ${0}" the value
+      case "TemplateLiteral": {
+        this.literalIdentifiers.set(id.name, {
+          value: toLiteral(childNode),
+          type: childNode.type
+        });
         break;
       }
 
@@ -520,7 +540,7 @@ export class VariableTracer extends EventEmitter {
           ...getMemberExpressionIdentifier(
             childNode,
             {
-              externalIdentifierLookup: (name) => this.literalIdentifiers.get(name) ?? null
+              externalIdentifierLookup: (name) => this.literalIdentifiers.get(name)?.value ?? null
             }
           )
         ];
diff --git a/workspaces/tracer/test/assignments.spec.ts b/workspaces/tracer/test/assignments.spec.ts
@@ -138,7 +138,23 @@ test("it should be able to Trace a require Assignment with atob", () => {
   assert.strictEqual(eventOne.id, "xo");
 
   assert.ok(helpers.tracer.literalIdentifiers.has("ff"));
-  assert.strictEqual(helpers.tracer.literalIdentifiers.get("ff"), "os");
+  assert.deepEqual(helpers.tracer.literalIdentifiers.get("ff"), {
+    value: "os",
+    type: "Literal"
+  });
+});
+
+test("it should be able to Trace template literals who has being assigned", () => {
+  const helpers = createTracer();
+
+  helpers.walkOnCode(`
+    const x = \`hello \${name}\`;
+  `);
+  assert.ok(helpers.tracer.literalIdentifiers.has("x"));
+  assert.deepEqual(helpers.tracer.literalIdentifiers.get("x"), {
+    value: `hello \${${0}}`,
+    type: "TemplateLiteral"
+  });
 });
 
 test("it should be able to Trace a global assignment using a LogicalExpression", () => {

Original file line number	Diff line number	Diff line change
`@@ -4,3 +4,4 @@ import type { ESTree } from "meriyah";`
`4`	`4`	`export function toLiteral(templateLiteral: ESTree.TemplateLiteral) {`
`5`	`5`	return templateLiteral.quasis.map(({ tail, value: { raw } }, i) => (tail ? raw : `${raw}\${${i}}`)).join("");
`6`	`6`	`}`
	`7`	`+`
Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ export class RequireCallExpressionWalker {`
`95`	`95`	`const nodeArguments = getCallExpressionArguments(`
`96`	`96`	`node,`
`97`	`97`	`{`
`98`		`- externalIdentifierLookup: (name) => this.tracer.literalIdentifiers.get(name) ?? null`
	`98`	`+ externalIdentifierLookup: (name) => this.tracer.literalIdentifiers.get(name)?.value ?? null`
`99`	`99`	`}`
`100`	`100`	`);`
`101`	`101`