injection-and-dangerous-sinks

Injection and Dangerous Sinks

Overview

Injection is attacker data crossing from the data channel into the code channel of an interpreter: SQL, a shell, a template engine, an XML parser, a deserializer. The fix is almost always structural — keep data and code in separate channels — not escaping.

Core principle: the sink is only half the finding. Trace the value back to a source the attacker controls before you call it injection; a constant or a server-side config value in the same position is not.

1. SQL Injection (CWE-89)

Only string-built SQL counts. Parameter binding and ORM query builders are the control working.

// ❌
rows, _ := db.Query("SELECT * FROM users WHERE email = '" + email + "'")
// ✅
rows, _ := db.Query("SELECT * FROM users WHERE email = $1", email)

Where it hides in ORM code: Django .raw(), .extra(), RawSQL; SQLAlchemy text(f"…"); JPA createQuery("… " + x) (JPQL injection) and createNativeQuery; Spring JdbcTemplate with concatenation; Prisma $queryRawUnsafe/$executeRawUnsafe; Sequelize literal(); Knex raw() with template strings. Identifiers (ORDER BY, column, table names) cannot be bound — they need an allowlist:

# ❌ sort comes from the query string
cur.execute(f"SELECT * FROM tasks ORDER BY {sort}")
# ✅
cur.execute(f"SELECT * FROM tasks ORDER BY {SORTABLE[sort]}")  # dict lookup; KeyError → 400

2. NoSQL Operator Injection (CWE-943)

A JSON body can carry an object where a string was expected.

// ❌ body {"email": "[email protected]", "password": {"$ne": null}} matches any password
const user = await Users.findOne({ email: req.body.email, password: req.body.password });
// ✅ force scalar types at the boundary (schema validation or String())
const user = await Users.findOne({ email: String(req.body.email) });

Also $where, $function and mapReduce with user-built JavaScript.

3. OS Command Injection (CWE-78)

The dangerous part is the shell. sh -c, shell=True, child_process.exec, backticks, system(), popen().