Skip to content

Enhance Node SQLi Injection Semgrep rule to Support Sequelize

Bhavya Kaushal requested to merge node-sqli-injection-sequelize into main

The MR addresses the issue : gitlab-org/gitlab#416984 (closed)

Modified the rule-node_sqli_injection.yml rule to reflect the following changes:

  1. Add support for Sequelize
  2. Optimize the existing rule patterns
  3. Add more patterns that cover additional SQL injection cases (i.e. the cases where request parameter is passed onto another method before it gets appended to SQL query and gets executed.)

Modified the rule-node_sqli_injection.js file to reflect the following changes:

  1. Add multiple additional test cases
  2. Add semgrep test annotations

Merge request reports