Description

This detector identifies SQL injection vulnerabilities in NestJS applications using Sequelize ORM. It specifically targets the sequelize.query() method when user-controlled data flows into the first parameter without proper sanitization, which can allow attackers to execute arbitrary SQL commands.

Detection Strategy

• The application must import modules from the '@nestjs' package (or packages containing '@nestjs' in their name)

• Code must contain a call to a method ending with 'sequelize.query'

• The first argument to the sequelize.query() call must be identified as containing unsafe, user-controlled data

• The unsafe data flow is determined by tracing the argument back to sources that are not properly sanitized or validated

Vulnerable code example

import { Controller, Get, Param } from '@nestjs/common';
import { Sequelize } from 'sequelize';

@Controller('users')
export class UserController {
  constructor(private readonly sequelize: Sequelize) {}

  @Get('vulnerable/:id')...

✅ Secure code example

import { Controller, Get, Param } from '@nestjs/common';
import { Sequelize } from 'sequelize';

@Controller('users')
export class UserController {
  constructor(private readonly sequelize: Sequelize) {}

  @Get('vulnerable/:id')...