edubadges / smart-contracts Goto Github PK

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Badge\ Class.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $1 is used by concatenation
   Line 19: const entity = await query("SELECT", "entities", "WHERE entity = $1;", [from]);
   Line 29: const institution = await query("SELECT", "institutions", "WHERE institution = $1;"

2. $3 is used by concatenation
   Line 41: + "ON CONSTRAINT endorseclasses_pkey DO UPDATE SET endorsed = $3;"

3. $1, $2, $3 is used by concatenation
   Line 45: const changed = await query("UPDATE", "endorseclasses", "SET endorsed = $3 WHERE class = $1 AND entity = $2;"

In smart-contract module, Entity.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. The WHERE clause uses $1 by concatenation Line 12,13: //Check if the institution exists and is allowed to create/unwithdraw entities. const institution = await query("SELECT", "institutions", "WHERE institution = $1;", [from]);

2. $2 and $3 are directly used by concatenation Line 27: "ON CONFLICT ON CONSTRAINT entities_pkey DO UPDATE SET allowed = true, name = $3 WHERE entities.institution = $2;", [payload.receiver, from, payload.name]);

3. $1 and $2 are used by concatenation Line 34: const changed = await query("UPDATE", "entities", "SET allowed = false WHERE entity = $1 AND institution = $2;"

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Metadata.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $1 is used by concatenation
   Line 15: const entity = await query("SELECT", "entities", "WHERE entity = $1;", [from]);
   Line 24: const institution = await query("SELECT", "institutions", "WHERE institution = $1;"

2. $1, $2 and $2 are used by concatenation
   Line 30: const changed = await query("UPDATE", "badgeclasses", "SET metadata = $3 WHERE class = $1 AND first_endorser = $2;", [payload.badgeClass, from, payload.metadata]);

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Badge.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $1 is used by concatenation
   Line 16: const entity = await query("SELECT", "entities", "WHERE entity = $1;", [from]);

2. $1 is used by concatenation
   Line 25: const institution = await query("SELECT", "institutions", "WHERE institution = $1;"

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Institutions.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $2 is used by concatenation
   Line 23:"ON CONSTRAINT institutions_pkey DO UPDATE SET name = $2, allowed = true;"
2. $1 is used by concatenation

Line 26:const changed = await query("UPDATE", "institutions", "SET allowed = false WHERE institution = $1;"