node-typescript-security-pitfalls

Node and TypeScript Security Pitfalls

Overview

TypeScript types vanish at runtime: req.query.id: string can arrive as an array or an object. Most Node findings come from that gap, from exec with a template string, from raw-query escape hatches in otherwise safe ORMs, and — in Next.js — from forgetting that a server action is a public endpoint.

1. Runtime Types Are Not Declared Types

// ❌ ?id[$ne]=x or ?id[]=a&id[]=b gives an object or array, not a string
const doc = await Orders.findOne({ id: req.query.id as string, owner: user.id });
// ✅ validate at the boundary (zod/valibot/class-validator) and coerce
const { id } = z.object({ id: z.string().uuid() }).parse(req.query);

Length, includes and equality checks on an unvalidated query value can be bypassed the same way.

2. child_process (CWE-78, CWE-88)

// ❌ shell
exec(`convert ${file} out.png`);
spawn("git", ["clone", url], { shell: true });
// ✅ no shell, end of options
execFile("git", ["clone", "--", url, dir]);

Also check the env option for request-controlled keys (NODE_OPTIONS=--require …).

3. Raw Queries in Safe ORMs (CWE-89)

Library	Unsafe	Safe
Prisma	$queryRawUnsafe, $executeRawUnsafe, Prisma.raw()	$queryRaw tagged template, model methods
TypeORM	query("… " + x), .where(\id = ${id}`)`	.where("id = :id", { id })
Sequelize	sequelize.query(\… ${x}`), literal(x)`	replacements / bind
Knex	knex.raw(\… ${x}`)`	knex.raw("… ?", [x])
Drizzle	sql.raw(x)	sql\… ${x}``

Mongo/Mongoose: operator injection from JSON bodies (section 1), $where.

4. Next.js Server Actions and Route Handlers

• Every exported async function in a "use server" file is a callable POST endpoint, whether or not a page renders a form for it. Each must authenticate and authorize inside the action.

// ❌ the page is admin-only, the action is not
"use server";
export async function deleteUser(id: string) { await db.user.delete({ where: { id } }); }
// ✅
export async function deleteUser(id: string) {
  const session = await auth();
  if (session?.user.role !== "admin") throw new Error("forbidden");
  await db.user.delete({ where: { id } });
}