smart-contracts/Badge.txt : Database queries being formed with concatenation of strings/stringified values

[sveeke]

Database queries being formed with concatenation of strings/stringified values

In smart-contract module, Badge.txt file, query is constructed using string concatenation and uses parameters directly, which may lead to query injection issues.

The attack vector is a peer node in the blockchain community - which can send malicious parameters causing SQL injection.

1. $1 is used by concatenation
   Line 16: const entity = await query("SELECT", "entities", "WHERE entity = $1;", [from]);

2. $1 is used by concatenation
   Line 25: const institution = await query("SELECT", "institutions", "WHERE institution = $1;"

[wdenbakker]

See #5 (comment).