smart-contracts/Institutions.txt : Database queries being formed with concatenation of strings/stringified values

[sveeke]

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Institutions.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $2 is used by concatenation
   Line 23:"ON CONSTRAINT institutions_pkey DO UPDATE SET name = $2, allowed = true;"
2. $1 is used by concatenation

Line 26:const changed = await query("UPDATE", "institutions", "SET allowed = false WHERE institution = $1;"

[wdenbakker]

See #5 (comment).