Description

This detector identifies unsafe Sequelize database connections in TypeScript code that use empty or missing passwords. Empty passwords in database connections create a significant security vulnerability as they allow unauthorized access to the database without authentication, potentially exposing sensitive data and allowing malicious operations.

Detection Strategy

• The file must import the 'sequelize' module or library

• A Sequelize constructor call is identified in the code

• The constructor configuration contains an empty password field or the password parameter is missing entirely

• The vulnerability is reported at the location of the unsafe Sequelize constructor call

Vulnerable code example

import { Sequelize } from 'sequelize';

// VULNERABLE: null password allows unauthenticated database access
const sequelize = new Sequelize("database", "user", null, {
    host: "localhost",
    dialect: "mysql"
});
...

✅ Secure code example

import { Sequelize } from 'sequelize';

// SECURE: Password from environment variable prevents hardcoded credentials
const sequelize = new Sequelize("database", "user", process.env.DB_PASSWORD, {
    host: "localhost",
    dialect: "mysql"
});
...