search

ag-grid / ag-grid-server-side-nodejs-example

21 stars 24 forks source link

SQL injection vulnerabilities #33

Open joshkel opened 1 year ago

joshkel commented 1 year ago

I noticed that this repo makes no attempt to validate inputs or escape its SQL. I realize that it's just an example, but, since it describes itself as a reference implementation and is recommended from https://www.ag-grid.com/react-data-grid/server-side-operations-nodejs/ with no caveats or warnings, it seems to me that it should either properly handle its SQL or include highly visible warnings indicating these limitations.

miszczu commented 5 months ago

I agree that it should be pointed out as a warning in both ag-grid documentation page and in this repo's README file