admin管理员组

文章数量:1294707

With sequelize query builder, I am doing

findOne({where: {foo: myStringValue}})

Is there a chance of injection if myStringValue is not a string as I expected?

It seems like myStringValue could (somehow) possibly be {someEvilOperator: "someEvilData"} (let's assume an upstream flaw let that evil data leak). However Sequelize seems to use operators whose keys are symbols, so I cannot see how corrupt data could translate to actual Sequelize operators.

Is there a risk here, or is it safe enough?

Is it good practice to wrap all values as String(myStringValue), or is it unnecessary?

本文标签： sequelizejsSequelize query builder injection safetyStack Overflow

版权声明：本文标题：sequelize.js - Sequelize query builder injection safety - Stack Overflow 内容由网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：http://www.betaflare.com/web/1741604557a2387898.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。