// ─────────────────────────────────────────────────────────────────────────────
// A05:2025 INJECTION (2021: A03 same name, down from #3; includes XSS)
// ─────────────────────────────────────────────────────────────────────────────
// WHAT : Untrusted data is sent to an interpreter as part of a command or
// query, so data becomes code.
// HAPPENS : SQLi (string concat into SQL); NoSQLi ({ $gt: '' } from JSON body
// into Mongo); command injection (exec('ping ' + host)); XSS —
// reflected / stored / DOM (innerHTML, document.write, eval);
// SSTI (user string compiled as template); LDAP / XPath injection;
// header injection (CRLF in redirect Location / Set-Cookie); log
// injection; ORM injection via raw(); GraphQL injection.
// SPOT : template literals or + building SQL/shell/HTML; `exec(`; `$where`;
// req.body passed straight into find(); innerHTML / dangerouslySet
// InnerHTML / v-html; `new Function`; `res.redirect(req.query.next)`;
// Handlebars.compile(userInput).
// FIX : parameterized queries / prepared statements ($1, ?); ORM query
// builders; schema validation (zod/joi) rejecting objects where
// strings expected; execFile with argv array (no shell); contextual
// output encoding (escapeHtml, attr, JS, URL); textContent not
// innerHTML; sanitizer (DOMPurify) for rich text; CSP as defense in
// depth; least-privilege DB user; allowlists over denylists.
// SAY : CWE-89 SQL Injection, CWE-943 NoSQL Injection, CWE-78 OS Command
// Injection, CWE-79 XSS, CWE-94 Code Injection, CWE-1336 SSTI,
// CWE-113 HTTP Response Splitting. Pitch: "Separate code from data:
// parameterize, validate on input, encode on output, CSP as backstop."
// ─────────────────────────────────────────────────────────────────────────────
'use strict';
const assert = require('node:assert/strict');
// ── 1. SQL injection
// VULNERABLE:
// const sql = `SELECT * FROM users WHERE email = '${email}' AND pw = '${pw}'`;
// db.query(sql); // email = "' OR 1=1 --"
// FIXED: query text is constant; values travel separately as parameters.
function buildVulnerableSql(email) { // shown ONLY to demonstrate; never executed
return `SELECT * FROM users WHERE email = '${email}'`;
}
function buildSafeQuery(email) {
return { text: 'SELECT * FROM users WHERE email = $1', values: [email] };
}
const payload = "' OR 1=1 --";
assert.equal(buildVulnerableSql(payload), "SELECT * FROM users WHERE email = '' OR 1=1 --'"); // the WHERE is gone
const q = buildSafeQuery(payload);
assert.equal(q.text, 'SELECT * FROM users WHERE email = $1'); // text unchanged by input
assert.deepEqual(q.values, ["' OR 1=1 --"]); // payload is just a string value
assert.equal(q.text.includes(payload), false);
// ── 2. NoSQL injection
// VULNERABLE:
// const user = await User.findOne({ email: req.body.email, password: req.body.password });
// body = { "email": "admin@x.com", "password": { "$gt": "" } } -> matches any password
// FIXED: validate types at the boundary; reject operator keys.
function requireString(v, field) {
if (typeof v !== 'string') throw new TypeError(`${field} must be a string`);
if (v.length === 0 || v.length > 256) throw new RangeError(`${field} length`);
return v;
}
function loginFilter(body) {
return { email: requireString(body.email, 'email'), password: requireString(body.password, 'password') };
}
assert.deepEqual(loginFilter({ email: 'a@b.c', password: 'hunter2' }), { email: 'a@b.c', password: 'hunter2' });
assert.throws(() => loginFilter({ email: 'admin@x.com', password: { $gt: '' } }), /password must be a string/);
assert.throws(() => loginFilter({ email: { $ne: null }, password: 'x' }), /email must be a string/);
function hasOperatorKey(obj) {
if (obj === null || typeof obj !== 'object') return false;
return Object.keys(obj).some((k) => k.startsWith('$') || hasOperatorKey(obj[k]));
}
assert.equal(hasOperatorKey({ a: { b: { $where: 'this.x' } } }), true);
assert.equal(hasOperatorKey({ a: 'plain' }), false);
// ── 3. OS command injection
// VULNERABLE:
// exec(`ping -c 1 ${req.query.host}`); // host = "8.8.8.8; rm -rf /" (shell parses it)
// FIXED: execFile with an argv array — no shell, so metacharacters are inert. Validate anyway.
// const { execFile } = require('node:child_process');
// execFile('ping', ['-c', '1', host], { timeout: 5000 }, cb);
const HOSTNAME = /^[A-Za-z0-9.-]{1,253}$/;
function pingArgs(host) {
if (!HOSTNAME.test(host)) throw new Error('invalid host');
return ['-c', '1', host];
}
assert.deepEqual(pingArgs('example.com'), ['-c', '1', 'example.com']);
assert.throws(() => pingArgs('8.8.8.8; rm -rf /'), /invalid host/);
assert.throws(() => pingArgs('$(whoami)'), /invalid host/);
assert.throws(() => pingArgs('a.com && cat /etc/passwd'), /invalid host/);
// ── 4. XSS — output encoding
// VULNERABLE:
// res.send(`Hello ${req.query.name}
`); // reflected
// el.innerHTML = comment.body; // stored / DOM
// location.href = params.get('next'); // DOM XSS via javascript: URL
// FIXED: encode for the HTML context; textContent in the DOM; DOMPurify for rich text.
const HTML_ESCAPES = { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''', '/': '/' };
function escapeHtml(s) { return String(s).replace(/[&<>"'/]/g, (c) => HTML_ESCAPES[c]); }
const xss = '';
assert.equal(escapeHtml(xss), '<script>alert(document.cookie)</script>');
assert.equal(escapeHtml(xss).includes('<'), false);
assert.equal(escapeHtml('" onmouseover="alert(1)'), '" onmouseover="alert(1)');
assert.equal(escapeHtml("'>
"), ''><img src=x onerror=alert(1)>');
assert.equal(escapeHtml('a&b'), 'a&b');
// URL context: only allow http(s) for user-supplied links (blocks javascript: and data:)
function safeHref(href) {
try { const u = new URL(href, 'https://example.com'); return ['http:', 'https:'].includes(u.protocol) ? u.href : '#'; }
catch { return '#'; }
}
assert.equal(safeHref('javascript:alert(1)'), '#');
assert.equal(safeHref('data:text/html,'), '#');
assert.equal(safeHref('/profile'), 'https://example.com/profile');
// CSP (defense in depth — stops inline script execution even if encoding is missed):
const csp = "default-src 'self'; script-src 'self' 'nonce-{random}'; object-src 'none'; base-uri 'none'";
assert.equal(csp.includes("'unsafe-inline'"), false);
// ── 5. Server-side template injection (SSTI)
// VULNERABLE:
// const tpl = Handlebars.compile(req.body.template); // user controls the TEMPLATE, not just data
// ejs.render(`Hello ${req.query.name}`); // name = "<%= process.mainModule.require('child_process')... %>"
// FIXED: templates are static files from the repo; user input is only ever DATA passed to render.
const templates = { welcome: (d) => `Hello ${escapeHtml(d.name)}` };
function render(name, data) {
if (!Object.hasOwn(templates, name)) throw new Error('unknown template');
return templates[name](data);
}
assert.equal(render('welcome', { name: '{{constructor.constructor("return process")()}}' }),
'Hello {{constructor.constructor("return process")()}}');
assert.throws(() => render('__proto__', {}), /unknown template/);
// ── 6. Header injection (CRLF) / LDAP (mention)
// VULNERABLE: res.setHeader('Location', req.query.next); // next = "/x\r\nSet-Cookie: admin=1"
// FIXED: strip CR/LF; Node's setHeader also throws on them — keep that as a backstop.
function headerValue(v) {
if (/[\r\n]/.test(v)) throw new Error('CRLF in header');
return v;
}
assert.throws(() => headerValue('/x\r\nSet-Cookie: admin=1'), /CRLF/);
assert.equal(headerValue('/dashboard'), '/dashboard');
// LDAP: escape ( ) * \ NUL in filter values, or use a library with parameterized filters (CWE-90).
console.log('ok: owasp/a05-injection.js');