picpeak/backend/SQL_INJECTION_FIX_MIGRATION.md

SQL Injection Fix Migration Guide

Overview

This document describes the SQL injection vulnerability fixes applied to the PicPeak backend and the migration process for deploying these fixes to production.

Vulnerabilities Fixed

1. WhereRaw Date Queries (High Risk)

Location: adminDashboard.js

• Issue: Direct string interpolation in SQL date calculations
• Example: .whereRaw(\timestamp >= datetime("now", "-${days} days")`)`
• Fix: Replaced with parameterized queries using ISO date strings

2. LIKE Pattern Injection (Medium Risk)

Locations: adminEvents.js, adminPhotos.js

• Issue: Unescaped user input in LIKE queries
• Example: .where('event_name', 'like', \%${search}%`)`
• Fix: Added proper escaping for LIKE special characters (%, _, )

3. Dynamic Column/Order Injection (Low Risk)

Locations: Various sorting operations

• Issue: Unvalidated column names in ORDER BY
• Fix: Whitelist validation for sort columns and orders

Files Changed

1. Created: backend/src/utils/sqlSecurity.js

   • Central security utility functions
   • sanitizeDays() - Validates numeric input
   • escapeLikePattern() - Escapes LIKE wildcards
   • validateSortColumn() - Whitelist validation
   • validateSortOrder() - Ensures only 'asc' or 'desc'

2. Modified: backend/src/routes/adminDashboard.js

   • Lines 21-24, 39-41, 45-47, 57-61, 65-68: Replaced whereRaw with parameterized queries
   • Line 4: Added security utility imports
   • Line 198: Added sanitizeDays for analytics

3. Modified: backend/src/routes/adminEvents.js

   • Line 11: Added escapeLikePattern import
   • Lines 156-161: Escaped search patterns in LIKE queries

4. Modified: backend/src/routes/adminPhotos.js

   • Line 9: Added escapeLikePattern import
   • Lines 477-478: Escaped search patterns in LIKE queries

Migration Steps

1. Pre-Deployment Testing

# Run security utility tests
cd backend
node scripts/test-sql-security.js

# Run verification script
node scripts/verify-sql-fixes.js

2. Development Environment Testing

# Start development server
npm run dev

# Test key endpoints:
curl http://localhost:3001/api/admin/dashboard/stats -H "Authorization: Bearer YOUR_TOKEN"
curl http://localhost:3001/api/admin/events?search=test -H "Authorization: Bearer YOUR_TOKEN"
curl http://localhost:3001/api/admin/dashboard/analytics?days=7 -H "Authorization: Bearer YOUR_TOKEN"

3. Production Deployment

Option A: Docker Deployment

# Pull latest changes
git pull

# Rebuild and restart
docker-compose down
docker-compose up -d --build

Option B: PM2 Deployment

# Pull latest changes
git pull

# Install dependencies (if any)
cd backend
npm install

# Restart with PM2
pm2 restart picpeak-backend

4. Post-Deployment Verification

1. Monitor Logs:

   # Docker
   docker-compose logs -f backend
   
   # PM2
   pm2 logs picpeak-backend
   

2. Test Critical Functions:

   • Admin dashboard loads correctly
   • Event search works with special characters
   • Analytics charts display properly
   • Photo search functions normally

3. Check Error Rates:

   • Monitor for any 500 errors
   • Check database query logs for errors

Testing Special Characters

After deployment, test these scenarios:

1. Search with wildcards: Search for "50%" or "user_name"
2. Search with quotes: Search for "O'Brien"
3. Date range: Change analytics to different day ranges
4. Malicious input: Try "'; DROP TABLE --" (should return no results)

Rollback Instructions

If issues occur, see SQL_INJECTION_FIX_ROLLBACK.md for immediate rollback steps.

Performance Impact

• Minimal performance impact expected
• Date calculations now use ISO strings instead of SQLite functions
• LIKE pattern escaping adds negligible overhead
• All changes maintain existing query optimization

Security Improvements

1. Eliminated SQL Injection Vectors: No more direct string interpolation
2. Input Validation: All user inputs are validated/sanitized
3. Parameterized Queries: Using Knex's built-in parameterization
4. Defense in Depth: Multiple layers of protection

Future Recommendations

1. Add request validation middleware
2. Implement rate limiting on search endpoints
3. Add SQL query logging for security auditing
4. Consider using prepared statements for complex queries

Questions/Support

If you encounter any issues during migration:

1. Check the rollback plan first
2. Review error logs for specific issues
3. Test individual endpoints to isolate problems
4. Contact development team if needed