الـ SQL Injection والـ Parameterization: الـ data ما تبقاش code

const get = async (label, params) => {
  const r = await fetch("http://localhost:3000/products?" + new URLSearchParams(params));
  console.log(`\n▶ ${label}\n  ${r.status}`, (await r.text()).slice(0, 230));
};

await get("search عادي", { q: "ماوس" });
// 1) نكسر الـ string ونضيف شرط دايمًا صح، ونعلّق على الباقي بـ --
await get("1) OR true: المنتجات المخفية", { q: "' OR true --" });
// 2) UNION: نلزق نتيجة query تانية بنفس عدد الـ columns
await get("2) UNION: الـ emails والـ hashes", { q: "' UNION SELECT id, email, length(password_hash) FROM users --" });
// 3) الـ error بيكشف أسماء الـ columns
await get("3) error-based", { q: "' AND 1=CAST((SELECT password_hash FROM users LIMIT 1) AS int) --" });
// 4) blind: مفيش data بترجع، بس الوقت بيقول الإجابة
const t = Date.now();
await get("4) time-based: sara admin؟", { sort: "(SELECT CASE WHEN is_admin THEN (SELECT 1 FROM pg_sleep(1)) ELSE 1 END FROM users WHERE id=1)" });
console.log("  الوقت:", Date.now() - t, "ms");
// 5) ORDER BY ما ينفعش فيه parameter، فالناس بتلزقه. والـ query من غير params بتقبل أكتر من statement
await get("5) ORDER BY + statement تاني", { sort: "price; DROP TABLE users --" });
await get("   الـ users لسه موجودة؟", { q: "' UNION SELECT id, email, 0 FROM users --" });

$ node server.js & sleep 1.5; node attack.js; kill $!
API: http://localhost:3000
SQL: SELECT id, name, price FROM products WHERE hidden = false AND name LIKE '%ماوس%' ORDER BY id LIMIT 10

▶ search عادي
  200 [{"id":2,"name":"ماوس","price":350}]
SQL: SELECT id, name, price FROM products WHERE hidden = false AND name LIKE '%' OR true --%' ORDER BY id LIMIT 10

▶ 1) OR true: المنتجات المخفية
  200 [{"id":1,"name":"كيبورد","price":900},{"id":2,"name":"ماوس","price":350},{"id":3,"name":"شنطة لابتوب","price":600},{"id":4,"name":"100% قطن تيشيرت","price":250},{"id":5,"name":"نموذج أولي سري","price":1}]
SQL: SELECT id, name, price FROM products WHERE hidden = false AND name LIKE '%' UNION SELECT id, email, length(password_hash) FROM users --%' ORDER BY id LIMIT 10

▶ 2) UNION: الـ emails والـ hashes
  200 [{"id":1,"name":"كيبورد","price":900},{"id":1,"name":"[email protected]","price":29},{"id":2,"name":"ماوس","price":350},{"id":2,"name":"[email protected]","price":29},{"id":3,"name":"شنطة لابتوب","price":600},{"id":4,"name":"100% ق
SQL: SELECT id, name, price FROM products WHERE hidden = false AND name LIKE '%' AND 1=CAST((SELECT password_hash FROM users LIMIT 1) AS int) --%' ORDER BY id 
…

import express from "express";
import { pool, seed } from "./db.js";

const app = express();
await seed();

// الـ identifiers (columns و ASC/DESC) ما ينفعش يبقوا parameters ← allowlist
const SORTS = { id: "id", name: "name", price: "price", "-price": "price DESC" };
// % و _ ليهم معنى جُوّه LIKE، فبنعملهم escape علشان يتدوّر عليهم كحروف عادية
const escapeLike = (s) => s.replace(/[\\%_]/g, "\\$&");

app.get("/products", async (req, res) => {
  const { q = "", sort = "id", limit = "10", category } = req.query;
  if (typeof q !== "string" || q.length > 100) return res.status(400).json({ error: "q غلط" });
  const orderBy = SORTS[sort];
  if (!orderBy) return res.status(400).json({ error: `sort لازم يبقى: ${Object.keys(SORTS)}` });
  const n = Number(limit);
  if (!Number.isInteger(n) || n < 1 || n > 50) return res.status(400).json({ error: "limit من 1 لـ 50" });
  // category ممكن تتكرر: ?category=tech&category=bags ← array واحدة كـ parameter
  const cats = category === undefined ? null : [category].flat().map(String);

  const sql = `SELECT id, name, price FROM products
               WHERE hidden = false
                 AND name ILIKE $1 ESCAPE '\\'
                 AND ($2::text[] IS NULL OR category = ANY($2))
               ORDER BY ${orderBy}, id
               LIMIT $3`;
  try {
    const { rows } = await pool.query(sql, [`%${escapeLike(q)}%`, cats, n]);
    res.json(rows);
  } catch (e) {
    console.error("db error:", e.message); // التفاصيل في الـ log بس
    res.status(500).json({ error: "حصلت مشكلة" });
  }
});

app.listen(3000, () => console.log("API: http://localhost:3000"));

$ node server.js & sleep 1.5; node attack.js; kill $!
API: http://localhost:3000

▶ search عادي
  200 [{"id":2,"name":"ماوس","price":350}]

▶ 1) OR true: المنتجات المخفية
  200 []

▶ 2) UNION: الـ emails والـ hashes
  200 []

▶ 3) error-based
  200 []

▶ 4) time-based: sara admin؟
  400 {"error":"sort لازم يبقى: id,name,price,-price"}
  الوقت: 2 ms

▶ 5) ORDER BY + statement تاني
  400 {"error":"sort لازم يبقى: id,name,price,-price"}

▶    الـ users لسه موجودة؟
  200 []

// db.js: pool + data للتجربة
import pg from "pg";

export const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });

export async function seed() {
  await pool.query(`
    DROP TABLE IF EXISTS products, users;
    CREATE TABLE users (id int PRIMARY KEY, email text, password_hash text, is_admin bool);
    CREATE TABLE products (id int PRIMARY KEY, name text, category text, price int, hidden bool DEFAULT false);
    INSERT INTO users VALUES
      (1, '[email protected]', '$argon2id$v=19$m=65536$c2FyYQ', true),
      (2, '[email protected]', '$argon2id$v=19$m=65536$bW9uYQ', false);
    INSERT INTO products (id, name, category, price, hidden) VALUES
      (1, 'كيبورد', 'tech', 900, false),
      (2, 'ماوس', 'tech', 350, false),
      (3, 'شنطة لابتوب', 'bags', 600, false),
      (4, '100% قطن تيشيرت', 'clothes', 250, false),
      (5, 'نموذج أولي سري', 'tech', 1, true);
  `);
}

let ok = 0, all = 0;
const check = (name, cond, extra = "") => { all++; if (cond) ok++; console.log(cond ? "✅" : "❌", name, extra); };
const get = async (params) => {
  const r = await fetch("http://localhost:3000/products?" + new URLSearchParams(params));
  return { status: r.status, body: await r.json() };
};
const names = (r) => (Array.isArray(r.body) ? r.body.map((p) => p.name).join("،") : "");

check("search عادي ← ماوس", names(await get({ q: "ماوس" })) === "ماوس");
check("OR true ← ولا نتيجة", names(await get({ q: "' OR true --" })) === "");
check("UNION ← ولا نتيجة", (await get({ q: "' UNION SELECT id, email, 1 FROM users --" })).body.length === 0);
const e = await get({ q: "' AND 1=CAST((SELECT password_hash FROM users LIMIT 1) AS int) --" });
check("error-based ← 200 فاضي، مش رسالة database", e.status === 200 && e.body.length === 0);
check("sort بـ SQL ← 400", (await get({ sort: "(SELECT pg_sleep(1))" })).status === 400);
check("sort=price; DROP ← 400", (await get({ sort: "price; DROP TABLE users" })).status === 400);
check("sort=-price ← الأغلى الأول", names(await get({ sort: "-price" })).startsWith("كيبورد"));
check("q=% ← بيدوّر على علامة % بس", names(await get({ q: "%" })) === "100% قطن تيشيرت");
check("q=_ ← ولا نتيجة", (await get({ q: "_" })).body.length === 0);
check("category=bags", names(await get({ category: "bags" })) === "شنطة لابتوب");
const two = new URLSearchParams([["category", "bags"], ["category", "clothes"], ["sort", "price"]]);
const r2 = await fetch("http://localhost:3000/products?" + two);
check("category متكررة ← array", names({ body: await r2.json() }) === "100% قطن تيشيرت،شنطة لابتوب");
check("category=' OR 1=1 -- ← ولا نتيجة", (await get({ category: "' OR 1=1 --" })).body.length === 0);
check("limit=0 ← 400، و limit=5; ← 400", (await get({ limit: "0" })).status === 400 && (await get({ limit: "5;" })).status === 400);
check("المنتج المخفي ما بيظهرش أبدًا", !names(await get({ q: "سري" })));
check("users لسه موجودة", (await get({ q: "" })).status === 200);
console.log(`\n${ok}/${all} نجحوا`);