Sql Injection in Feathersjs

Sql Injection in Feathersjs applications typically occurs through service method parameters that get passed directly to database queries without proper sanitization. The most common attack vectors include:

• Query parameters in find, get, patch, update, and remove service methods
• Custom service methods that construct raw SQL queries
• Dynamic query building using user input

Here's a vulnerable Feathersjs service pattern:

const sql = "SELECT * FROM users WHERE id = " + req.params.id;
const result = await db.query(sql);

An attacker could inject 1 OR 1=1 to bypass authentication or 1; DROP TABLE users; to destroy data. Feathersjs's default service patterns can be particularly vulnerable when developers override the standard query handling.

Another common pattern involves using feathers-sequelize or feathers-mongoose with dynamic query construction:

const unsafeQuery = {
  [req.query.field]: req.query.value
};
const results = await context.app.service('messages').find({ query: unsafeQuery });

This allows attackers to manipulate query parameters to access unauthorized data or modify query logic. The $ne, $gt, $lt, and other MongoDB operators can be abused similarly in NoSQL injection scenarios.

Detecting Sql Injection vulnerabilities in Feathersjs applications requires examining both the codebase and runtime behavior. Static analysis should focus on:

• Service methods that accept query parameters without validation
• Custom SQL query construction in hooks or service methods
• Dynamic query building using req.query or similar request data

middleBrick's black-box scanning approach is particularly effective for Feathersjs applications because it tests the actual API endpoints without requiring source code access. The scanner sends malicious payloads to your Feathersjs endpoints and analyzes the responses for injection indicators.

For Feathersjs applications using feathers-sequelize, middleBrick tests common injection patterns like:

curl -X GET "https://api.example.com/messages?email=' OR 1=1 --"

The scanner checks if the application returns unexpected results or error messages that reveal database structure. For NoSQL injection in feathers-mongoose, middleBrick tests for MongoDB operator injection like:

curl -X GET "https://api.example.com/users?email[$ne]=anything"

middleBrick also analyzes your OpenAPI/Swagger specification if provided, cross-referencing documented parameters with actual runtime behavior to identify mismatches that could indicate security issues. The scanner's 12 security checks include Input Validation testing specifically designed to catch injection vulnerabilities in API endpoints.

Feathersjs provides several native mechanisms to prevent Sql Injection. The most effective approach is using parameterized queries through the framework's built-in query sanitization:

const { Op } = require('sequelize');
const safeQuery = {
  id: {
    [Op.eq]: req.params.id // Properly escaped
  }
};
const results = await context.app.service('users').find({ query: safeQuery });

For feathers-mongoose applications, use the built-in query validation:

const safeQuery = {
  email: req.query.email
};
const results = await context.app.service('users').find({ query: safeQuery });

Implement hooks for input validation and sanitization:

const { HookContext } = require('@feathersjs/feathers');

module.exports = function sanitizeQuery() {
  return async (context: HookContext) => {
    const { params: { query } } = context;
    
    // Remove potentially dangerous operators
    const dangerousOperators = ['$where', '$eval', '$mapReduce'];
    dangerousOperators.forEach(op => {
      if (query[op]) {
        delete query[op];
      }
    });
    
    // Validate data types
    if (query.id) {
      context.params.query.id = parseInt(query.id);
    }
    
    return context;
  };
};

For custom SQL queries, always use parameterized statements:

const results = await db.query(
  'SELECT * FROM users WHERE id = ?',
  [req.params.id] // Parameter binding prevents injection
);

middleBrick's CLI tool can be integrated into your development workflow to continuously scan your Feathersjs API:

npm install -g middlebrick
middlebrick scan https://api.yourapp.com

This provides immediate feedback on injection vulnerabilities before they reach production. For CI/CD integration, add middleBrick to your GitHub Actions workflow to fail builds when security scores drop below your threshold.