Code RoomJSONB key injected into SQL

HardPrep Room Coding #2064

JSONB key injected into SQL

Code reviewSecurityDatabases & SQLSenior–Staff~24 min

Review this Node Postgres endpoint that filters a JSONB column by a client-chosen key.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 24 min

Mark a line and say what kind of problem it is.0 findings

1async function findByAttr(pool, key, value) {

2 const sql = `SELECT id FROM events WHERE data->>'${key}' = $1`;

3 const { rows } = await pool.query(sql, [value]);

4 return rows;

5}

6

7app.get('/events', async (req, res) => {

8 const { attr, val } = req.query;

9 const rows = await findByAttr(pool, attr, val);

10 res.json(rows);

11});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.