Security: SQL Injection Risk in Dynamic Query Construction

[tomaioo]

Summary

Security: SQL Injection Risk in Dynamic Query Construction

Problem

Severity: Medium | File: apps/web/e2e/scripts/get-magic-link-token.ts:L42

The file apps/web/e2e/scripts/get-magic-link-token.ts constructs a SQL LIKE pattern by string concatenation: value::text ILIKE ${'"email":"' + email + '"%'}. While the postgres library uses parameterized queries for the main query, the LIKE pattern is built via string concatenation before being passed as a parameter. If email contains special characters, it could affect pattern matching behavior or cause unexpected query results.

Solution

Sanitize or validate the email input before constructing the LIKE pattern. Consider using a more robust approach to query the JSON content, such as using PostgreSQL's JSON operators (e.g., value->>'email' = ${email}) instead of text matching on serialized JSON.

Changes

• apps/web/e2e/scripts/get-magic-link-token.ts (modified)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}