Why am I receiving "Unsanitized input from an HTTP parameter flows into send" Using standard Node Oracledb setup for GET? - Javascript

user68288
April 28, 2023
218 views
0 votes
2 Answers

My current environment is using an Angular frontend and Node Backend.

The line that is flagging is down below in the Controller code.

 res.send(rows);

Our database is Oracle so we are using the the package: https://www.npmjs.com/package/oracledb

Example GET Request from Frontend

  getJobResult(id): Observable<JobResult[]> {
    const url = environment.hosturl + "job";
    const httpOptions = {
      headers: new HttpHeaders({
        "Access-Control-Allow-Origin": "*",
        "Content-Type": "application/json",
      }),
      withCredentials: true,
      params: {
        id: id,
      },
    };
        return this._http.get(url, httpOptions).pipe(
      map((res) => {
        if (res[0] && JSON.stringify(res[0]).includes("ERROR_MSG")) {
          // Error in GET Result
          this.router.navigate(["/error"]);
        }
        
        return <JobResult[]>res;
      })
    );
  }

Example Controller in Backend for API

const job = require('../db_apis/job.js');


async function get(req, res, next) {
  try {
    const context = {};
    context.id = req.query.id;


    const rows = await job.find(context);

    res.send(rows);
    
    } catch (err) { 
res.sendStatus(404);
    next(err);
  }
}

module.exports.get = get;

The line above for res.send(rows) is what is flagging the error.

Example of the DB API file for API

const database = require('../services/database.js');

async function find(context) {

  let query = `SELECT  * FROM JOB WHERE JOB_ID = :V_ID`
  
console.log(query);
const binds = {
  V_ID: Number(context.id)
};
const result = await database.simpleExecute(query, binds, clientdetails);
  return result.rows;
}

module.exports.find = find;

simpleExecute function that is ran

async function simpleExecute(query, binds = [],clientdetails = [], opts = {}) {
  let conn;
  // Set Pool based on User
  let alias = 'client1';
  let simpleResult;
  console.log('Action for Client: ' + alias)

  opts.outFormat = oracledb.OBJECT;
  opts.autoCommit = true;

  try {
    // Get Connection
    conn = await oracledb.getConnection(alias);
    conn.callTimeout = 500 * 1000; // Reduced the timeout to 50 secs
    // Execute Statement
    simpleResult = await conn.execute(query, binds, opts);
  } catch (err) {
    console.error("Oracle Error ==>", err, "<== THIS IS WHERE THE ORACLE ERROR WILL SHOW!"); 
  } finally {
    // Finally close the connection
    if (conn) {
      try {
        await conn.close();
        console.log('Connection Closed.')
      } catch (err) {
        console.log('Error in close: ' + err);
      }
      // return the result
      console.log('Result Returned.');
      return simpleResult
    }
  } 
}

module.exports.simpleExecute = simpleExecute;

Any help would be greatly appreciated!

Answers

- Roksarr
- April 28, 2023 at 3:09 pm
- 0 votes
0
Looks that the returned rows from the job.find method is not serializable to JSON. This can happen if the data contains circular references, functions, or other non-serializable data types.

Try to check it. If so you can use a library like "lodash" or "underscore" to deep clone the data and remove any non-serializable properties.

Login or Signup to reply.

- VincentMenzel
- April 28, 2023 at 4:40 pm
- 0 votes
0
You need to provide it using bind objects which have a dir, val and type property described in the documentation:
https://node-oracledb.readthedocs.io/en/latest/user_guide/bind.html

Example for bind obj use:
```
const oracledb = require('oracledb');

const result = await connection.execute(
  `INSERT INTO countries VALUES (:country_id, :country_name)`,
  {
    country_id: { dir: oracledb.BIND_IN, val: 90, type: oracledb.NUMBER },
    country_name: { dir: oracledb.BIND_IN, val: "Tonga", type: oracledb.STRING }
  }
);

console.log("Rows inserted " + result.rowsAffected);
```
Login or Signup to reply.