Application Security II: Injection, SSRF, Deserialisation, Secrets

-- SQL injection: build queries with parameters, never string concatenation
db.query(`SELECT * FROM users WHERE email = '${email}'`)          -- vulnerable
db.query('SELECT * FROM users WHERE email = $1', [email])          -- safe: the driver sends data separately
-- dynamic ORDER BY: allow-list column names; identifiers cannot be parameters
const col = { created: 'created_at', amount: 'amount_kobo' }[req.query.sort] ?? 'created_at';

// NoSQL injection: { "email": { "$ne": null } } matches everyone → validate types with a schema (zod)
// command injection: execFile('convert', [inPath, outPath]), never exec(`convert ${name}`)
// prototype pollution: JSON with "__proto__" merged into objects → use Object.create(null) maps, schema validation

# unsafe deserialisation: never unpickle or Java-deserialise untrusted bytes; yaml.safe_load, not yaml.load
pickle.loads(request.data)     # remote code execution by design

import { lookup } from 'node:dns/promises'; import ipaddr from 'ipaddr.js';
async function safeTarget(url: string) {
  const u = new URL(url);
  if (u.protocol !== 'https:' || (u.port && u.port !== '443')) throw new Error('scheme/port not allowed');
  const { address } = await lookup(u.hostname);
  if (ipaddr.parse(address).range() !== 'unicast') throw new Error('private address');   // loopback, private, linkLocal…
  return { url: u, address };   // connect to this address (pin it) so DNS cannot change between check and use
}