Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Allow-list dynamic SQL identifiers and sort direction
Table/column names and ASC/DESC are not bindable — map user choices through a fixed allow-list, never interpolate them.
Bad example
| 1 | function listProducts(sortBy: string, dir: string) { |
| 2 | // ❌ identifiers and direction interpolated from input |
| 3 | return pool.query( |
| 4 | `SELECT * FROM products ORDER BY ${sortBy} ${dir}`, |
| 5 | ); |
| 6 | } |
| 7 | // sortBy = "(CASE WHEN (SELECT ...) THEN price ELSE name END)" -> blind injection / enumeration |
Explanation (EN)
Raw request text in SQL syntax can inject expressions even when value parameters are bound.
Objašnjenje (HR)
Sirovi tekst zahtjeva u SQL sintaksi može umetnuti izraze čak i kada su vrijednosti parametrizirane.
Good example
| 1 | const SORTABLE = { |
| 2 | name: 'name', |
| 3 | price: 'price', |
| 4 | created: 'created_at', |
| 5 | } as const; |
| 6 |
|
| 7 | function listProducts(sortBy: string, dir: string) { |
| 8 | // ✅ resolve identifier from a fixed map; reject anything unknown |
| 9 | const column = SORTABLE[sortBy as keyof typeof SORTABLE] ?? 'created_at'; |
| 10 | const direction = dir?.toLowerCase() === 'asc' ? 'ASC' : 'DESC'; |
| 11 | return pool.query( |
| 12 | `SELECT * FROM products ORDER BY ${column} ${direction}`, |
| 13 | ); |
| 14 | } |
Explanation (EN)
User input only selects a key into a server-defined map of safe column names, and direction collapses to one of two literals. The string interpolated into SQL can only ever be a value the developer authored, so injection is impossible.
Objašnjenje (HR)
Korisnički ulaz samo odabire ključ u mapi sigurnih imena stupaca koju definira poslužitelj, a smjer se svodi na jedan od dva literala. String koji se umeće u SQL uvijek može biti samo vrijednost koju je autor napisao, pa je injekcija nemoguća.
Notes (EN)
When a query needs dynamic identifiers or sort direction, map external choices to authorized server-owned SQL fragments and parameterize ordinary values.
Exceptions / Tradeoffs (EN)
Identifier quoting prevents syntax injection but does not authorize arbitrary columns or expressions; combine a trusted identifier API with an allowed selection policy.
Iznimke / Tradeoffi (HR)
Ispravno citiranje SQL identifikatora sprječava umetanje sintakse, ali ne odobrava proizvoljne stupce ili izraze. Pouzdan API za identifikatore kombiniraj s popisom dopuštenih odabira.