Fix SQL Injection (Legacy & Modern) in Feathers

SQL injection in FeathersJS typically manifests when developers bypass the abstraction layer to run raw SQL via Knex or Sequelize adapters. Even with modern ORMs, improper handling of user-supplied data in raw queries or custom hooks creates critical vulnerabilities. This guide covers neutralizing these vectors by enforcing parameterized inputs and leveraging built-in service abstractions.

The Vulnerable Pattern

// VULNERABLE: Direct string interpolation in a custom service method using Knex
async find(params) {
  const { category } = params.query;
  const knex = this.app.get('knexClient');
  // DANGER: User input is concatenated directly into the SQL string
  const result = await knex.raw(`SELECT * FROM products WHERE category = '${category}'`);
  return result.rows;
}

The Secure Implementation

The vulnerability exists because the database engine interprets the concatenated string as a single command, allowing an attacker to break out of the quote and append malicious SQL (e.g., ' OR 1=1--). The fix involves using Parameterized Queries where the SQL structure and the data are sent to the DB engine separately. By using the '?' placeholder, the driver ensures the input is treated strictly as a literal value. In Feathers, the most robust defense is sticking to the service's built-in find/get methods, which leverage the underlying adapter's protection mechanisms by default.

// SECURE: Use parameterized queries (bindings) or Feathers built-in query syntax
async find(params) {
  const { category } = params.query;
  const knex = this.app.get('knexClient');
// Option 1: Parameterized Raw Query (Safe)
const result = await knex.raw(‘SELECT * FROM products WHERE category = ?’, [category]);
// Option 2: Feathers Service Methods (Best Practice)
// This uses the internal query builder which handles sanitization automatically
return await this._find({
query: {
category: category
}
});
}