@aikidosec/firewall/sinks/Postgresjs.js

Zen by Aikido is an embedded Web Application Firewall that autonomously protects Node.js apps against common and critical attacks

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.Postgresjs = void 0;
const Context_1 = require("../agent/Context");
const checkContextForSqlInjection_1 = require("../vulnerabilities/sql-injection/checkContextForSqlInjection");
const SQLDialectPostgres_1 = require("../vulnerabilities/sql-injection/dialects/SQLDialectPostgres");
const wrapExport_1 = require("../agent/hooks/wrapExport");
class Postgresjs {
    constructor() {
        this.dialect = new SQLDialectPostgres_1.SQLDialectPostgres();
    }
    inspectQuery(args) {
        const context = (0, Context_1.getContext)();
        if (!context) {
            return undefined;
        }
        if (args.length > 0 && typeof args[0] === "string" && args[0].length > 0) {
            const sql = args[0];
            return (0, checkContextForSqlInjection_1.checkContextForSqlInjection)({
                sql: sql,
                context: context,
                operation: "sql.unsafe",
                dialect: this.dialect,
            });
        }
        return undefined;
    }
    wrap(hooks) {
        hooks
            .addPackage("postgres")
            .withVersion("^3.0.0")
            .onRequire((exports, pkgInfo) => {
            return (0, wrapExport_1.wrapExport)(exports, undefined, pkgInfo, {
                kind: undefined,
                modifyReturnValue: (args, returnValue) => {
                    (0, wrapExport_1.wrapExport)(returnValue, "unsafe", pkgInfo, {
                        kind: "sql_op",
                        inspectArgs: (args) => this.inspectQuery(args),
                    });
                    return returnValue;
                },
            });
        });
    }
}
exports.Postgresjs = Postgresjs;