@aikidosec/firewall/sinks/NodeSQLite.js

Zen by Aikido is an embedded Web Application Firewall that autonomously protects Node.js apps against common and critical attacks

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.NodeSQLite = void 0;
const Context_1 = require("../agent/Context");
const wrapExport_1 = require("../agent/hooks/wrapExport");
const checkContextForSqlInjection_1 = require("../vulnerabilities/sql-injection/checkContextForSqlInjection");
const SQLDialectSQLite_1 = require("../vulnerabilities/sql-injection/dialects/SQLDialectSQLite");
class NodeSQLite {
    constructor() {
        this.dialect = new SQLDialectSQLite_1.SQLDialectSQLite();
    }
    wrap(hooks) {
        const sqlFunctions = ["exec", "prepare"];
        // Omit node: prefix because its an internal module
        hooks.addBuiltinModule("sqlite").onRequire((exports, pkgInfo) => {
            const dbSyncProto = exports.DatabaseSync.prototype;
            for (const func of sqlFunctions) {
                (0, wrapExport_1.wrapExport)(dbSyncProto, func, pkgInfo, {
                    kind: "sql_op",
                    inspectArgs: (args) => this.inspectQuery(`node:sqlite.${func}`, args),
                });
            }
        });
    }
    inspectQuery(operation, args) {
        const context = (0, Context_1.getContext)();
        if (!context) {
            return undefined;
        }
        if (args.length > 0) {
            if (typeof args[0] === "string" && args[0].length > 0) {
                const sql = args[0];
                return (0, checkContextForSqlInjection_1.checkContextForSqlInjection)({
                    operation: operation,
                    sql: sql,
                    context: context,
                    dialect: this.dialect,
                });
            }
        }
        return undefined;
    }
}
exports.NodeSQLite = NodeSQLite;