3 ms·

I don't think you understand what the code is doing. That's a string templating function, not a raw templated string. `${formData.get('name')}` will get passed

I don't think you understand what the code is doing. That's a string templating function, not a raw templated string. `${formData.get('name')}` will get passed as a parameter in a var-arg, not stuck straight into the string.

wereHamster 4y ago
Right. The code converts all expressions into $N-parameters. However Postgres does not support parameters in all locations, eg. this would fail: import { tableName } from "../shared" sql`SELECT * FROM ${tableName} WHERE id=${formData.get('id')}` The @vercel/postgres package needs a big disclaimer that it works very differently from node-postgres and what is and is not allowed.
- jitl 4y ago
  That would result in an error then, not an injection
- porsager 4y ago
  They've looked at Postgres.js (https://github.com/porsager/postgres https://github.com/porsager/postgres) before — wouldn't mind if they enabled those other cases in the same way. Also, node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...
  - jmull 4y ago
    > node-postgres is ripe for sql injections because you just concatenate strings yourself when using it... Why the heck would you do that? I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.
    - heatmiser 4y ago
      The things I've seen because people don't want to learn an ORM's (or similar tech) API.
      - jmull 4y ago
        I mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients. Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.
        porsager 4y ago
        It doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.
  - wereHamster 4y ago
    The examples on https://node-postgres.com/features/queries https://node-postgres.com/features/queries clearly show how to use parametrized queries. Of course you /can/ concatenate strings, no library in the JS land will prevent you from doing that. But the examples are pretty clear how to do it correctly.
    - porsager 4y ago
      Well that's exactly what Postgres.js will do for you ;)

wereHamster 4y ago

Right. The code converts all expressions into $N-parameters. However Postgres does not support parameters in all locations, eg. this would fail: import { tableName } from "../shared" sql`SELECT * FROM ${tableName} WHERE id=${formData.get('id')}` The @vercel/postgres package needs a big disclaimer that it works very differently from node-postgres and what is and is not allowed.

jitl 4y ago
That would result in an error then, not an injection
porsager 4y ago
They've looked at Postgres.js (https://github.com/porsager/postgres https://github.com/porsager/postgres) before — wouldn't mind if they enabled those other cases in the same way. Also, node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...
- jmull 4y ago
  > node-postgres is ripe for sql injections because you just concatenate strings yourself when using it... Why the heck would you do that? I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.
  - heatmiser 4y ago
    The things I've seen because people don't want to learn an ORM's (or similar tech) API.
    - jmull 4y ago
      I mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients. Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.
      - porsager 4y ago
        It doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.
- wereHamster 4y ago
  The examples on https://node-postgres.com/features/queries https://node-postgres.com/features/queries clearly show how to use parametrized queries. Of course you /can/ concatenate strings, no library in the JS land will prevent you from doing that. But the examples are pretty clear how to do it correctly.
  - porsager 4y ago
    Well that's exactly what Postgres.js will do for you ;)