nearform / udaru

Open source Access Manager for node.js
https://nearform.github.io/udaru
MIT License
125 stars 19 forks source link

Configure linter to detect unsafe SQLs #507

Open mihaidma opened 6 years ago

mihaidma commented 6 years ago

We could configure the linter to detect if the SQL tag is forgotten to be added in front of SQL template string: https://github.com/gajus/eslint-plugin-sql#eslint-plugin-sql-rules-no-unsafe-query ok:

const sqlQuery = SQL`
      DELETE FROM organization_policies
      WHERE org_id = ${id}
      AND policy_id = ${policyId}
    `

not ok:

const sqlQuery = `
      DELETE FROM organization_policies
      WHERE org_id = ${id}
      AND policy_id = ${policyId}
    `

The linter can detect if SQL is forgotten.

cianfoley-nearform commented 6 years ago

I had a look at this mihai... it's going to be a bit of a mess as we have SQL defined using capital letters and the plugin uses lowercase, not a problem except our object is also sql so when we refine we have that problem too so means more of a refactor