search

aws / aws-appsync-community

The AWS AppSync community
https://aws.amazon.com/appsync
Apache License 2.0
506 stars 32 forks source link

Feature request: Parameterised SQL queries in VTL #212

Open alextriaca opened 2 years ago

alextriaca commented 2 years ago

There is currently no way to execute a parameterised SQL query against the Aurora data API in VTL. Without this all but the most simple queries cannot be executed in VTL. While there is a variableMap field which looks like it should be parameterised, it simply concatenates the strings and is just as vulnerable to SQLi. There is a broad misconception about this in the community (https://github.com/aws/aws-appsync-community/issues/60#issuecomment-546791723) as this separation is the standard way of parametrising queries in all other SQL libraries (including boto3).

Request - please can the variableMap field be converted to allow parameterised queries or a new parameters field be added that parameterises the query being made against Aurora.

onlybakam commented 11 months ago

Hello, this is now possible with:

we recommend using JavaScript resolvers to interact with your Aurora data source