SQL injection from AWS Lambda event data in Sequel query

Critical Risk sql-injection
rubyaws-lambdasequelormsql-injection

What it is

SQL injection vulnerability where user-controlled event fields are interpolated into SQL strings in Sequel without parameters, potentially allowing attackers to exfiltrate data, modify tables, or run dangerous database commands with the application's database privileges through crafted input that alters the query.

ℹī¸ Configuration Fix

Configuration changes required - see explanation below.

💡 Explanation

ℹī¸ Configuration Fix

Configuration changes required - see explanation below.

💡 Explanation

Why it happens

Event fields are directly interpolated into Sequel SQL strings without using dataset APIs or parameter binding.

Root causes

String Interpolation in Sequel Queries

Event fields are directly interpolated into Sequel SQL strings without using dataset APIs or parameter binding.

Missing Sequel Dataset APIs

Failing to use Sequel's parameterized dataset methods in favor of raw SQL construction.

Fixes

1

Use Sequel Dataset APIs

Replace string interpolation with Sequel dataset methods that handle parameter binding automatically.

View implementation 
DB[:items].where(name: name).first instead of DB["SELECT * FROM items WHERE name = '#{name}'"]
2

Use Sequel Parameterized Queries

When raw SQL is needed, use Sequel's placeholder system with parameter binding.

View implementation 
DB['SELECT * FROM items WHERE name = ?', name] with bound parameters
3

Validate All Event Data

Implement strict validation for all Lambda event fields before using them in database operations.

View implementation 
Check data types, validate formats, use allow-lists, and enforce length limits

Detect This Vulnerability in Your Code

Sourcery automatically identifies sql injection from aws lambda event data in sequel query and many other security issues in your codebase.

Scan Your Code for Free Explore More Vulnerabilities