test

node-sample copy/index.js

@@ -0,0 +1,42 @@
+const express = require('express');
+const mysql = require('mysql');
+
+const app = express();
+const port = 3000;
+
+// Create a connection to the database
+const connection = mysql.createConnection({
+  host: 'localhost',
+  user: 'root',
+  password: 'password',
+  database: 'testdb'
+});
+
+// Connect to the database
+connection.connect((err) => {
+  if (err) {
+    console.error('Error connecting to the database:', err);
+    return;
+  }
+  console.log('Connected to the database');
+});
+
+// Route with a vulnerable SQL query (SQL Injection)
+app.get('/user/:id', (req, res) => {
+  const userId = req.params.id;
+
+  // Vulnerable SQL query: no input sanitization
+  const query = `SELECT * FROM users WHERE id = ${userId}`;
+
+  connection.query(query, (err, result) => {
+    if (err) {
+      res.status(500).send('Database query error');
+      return;
+    }
+    res.json(result);
+  });
+});
+
+app.listen(port, () => {
+  console.log(`Server running on http://localhost:${port}`);
+});

node-sample copy/package.json

@@ -0,0 +1,15 @@
+{
+    "name": "node-sql-injection-demo",
+    "version": "1.0.0",
+    "description": "A simple Node.js app with SQL injection vulnerability demonstration.",
+    "main": "app.js",
+    "scripts": {
+      "start": "node app.js"
+    },
+    "author": "Your Name",
+    "license": "ISC",
+    "dependencies": {
+      "express": "^4.18.2",
+      "mysql": "^2.18.1"
+    }
+  }

node-sample copy/run.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+../scripts/run-codeql.sh default --path=$(pwd) --override --language=javascript 
+
+#../scripts/run-codeql.sh security-and-quality --path=$(pwd) --override --language=javascript 
+
+#../scripts/run-codeql.sh "security-extended" --path=$(pwd) --override --language=javascript 

node-sample/run.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
-#../scripts/run-codeql.sh default --path=$(pwd) --override --language=javascript 
+../scripts/run-codeql.sh default --path=$(pwd) --override --language=javascript 
 
 #../scripts/run-codeql.sh security-and-quality --path=$(pwd) --override --language=javascript 
 
-../scripts/run-codeql.sh "security-extended" --path=$(pwd) --override --language=javascript 
+#../scripts/run-codeql.sh "security-extended" --path=$(pwd) --override --language=javascript