@aikidosec/firewall/sinks/MariaDB.js

Zen by Aikido is an embedded Application Firewall that autonomously protects Node.js apps against common and critical attacks, provides rate limiting, detects malicious traffic (including bots), and more.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.MariaDB = void 0;
const Context_1 = require("../agent/Context");
const wrapExport_1 = require("../agent/hooks/wrapExport");
const isPlainObject_1 = require("../helpers/isPlainObject");
const checkContextForSqlInjection_1 = require("../vulnerabilities/sql-injection/checkContextForSqlInjection");
const SQLDialectMySQL_1 = require("../vulnerabilities/sql-injection/dialects/SQLDialectMySQL");
const connectionFunctions = [
    "query",
    "execute",
    "prepare",
    "batch",
    "queryStream",
];
const poolFunctions = ["query", "execute", "batch"];
class MariaDB {
    constructor() {
        this.dialect = new SQLDialectMySQL_1.SQLDialectMySQL();
    }
    inspectQuery(args, operation) {
        const context = (0, Context_1.getContext)();
        if (!context) {
            return undefined;
        }
        if (args.length > 0 && typeof args[0] === "string" && args[0].length > 0) {
            const sql = args[0];
            return (0, checkContextForSqlInjection_1.checkContextForSqlInjection)({
                sql: sql,
                context: context,
                operation: `mariadb.${operation}`,
                dialect: this.dialect,
            });
        }
        if (args.length > 0 &&
            (0, isPlainObject_1.isPlainObject)(args[0]) &&
            args[0].sql &&
            typeof args[0].sql === "string") {
            const sql = args[0].sql;
            return (0, checkContextForSqlInjection_1.checkContextForSqlInjection)({
                sql: sql,
                context: context,
                operation: `mariadb.${operation}`,
                dialect: this.dialect,
            });
        }
        return undefined;
    }
    wrapConnection(exports, pkgInfo) {
        for (const fn of connectionFunctions) {
            (0, wrapExport_1.wrapExport)(exports.prototype, fn, pkgInfo, {
                kind: "sql_op",
                inspectArgs: (args) => this.inspectQuery(args, fn),
            });
        }
    }
    wrapPool(exports, pkgInfo) {
        for (const fn of poolFunctions) {
            (0, wrapExport_1.wrapExport)(exports.prototype, fn, pkgInfo, {
                kind: "sql_op",
                inspectArgs: (args) => this.inspectQuery(args, fn),
            });
        }
    }
    wrap(hooks) {
        hooks
            .addPackage("mariadb")
            .withVersion("^3.0.0")
            .onFileRequire("lib/connection-promise.js", (exports, pkgInfo) => {
            this.wrapConnection(exports, pkgInfo);
        })
            .onFileRequire("lib/connection-callback.js", (exports, pkgInfo) => {
            this.wrapConnection(exports, pkgInfo);
        })
            .onFileRequire("lib/pool-promise.js", (exports, pkgInfo) => {
            this.wrapPool(exports, pkgInfo);
        })
            .onFileRequire("lib/pool-callback.js", (exports, pkgInfo) => {
            this.wrapPool(exports, pkgInfo);
        })
            .addMultiFileInstrumentation(["lib/connection-promise.js", "lib/connection-callback.js"], connectionFunctions.map((fn) => ({
            name: fn,
            nodeType: "MethodDefinition",
            operationKind: "sql_op",
            bindContext: true,
            inspectArgs: (args) => this.inspectQuery(args, fn),
        })))
            .addMultiFileInstrumentation(["lib/pool-promise.js", "lib/pool-callback.js"], poolFunctions.map((fn) => ({
            name: fn,
            nodeType: "MethodDefinition",
            operationKind: "sql_op",
            bindContext: true,
            inspectArgs: (args) => this.inspectQuery(args, fn),
        })));
    }
}
exports.MariaDB = MariaDB;