Rule Definition
Node.js third-party module query-mysql is vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database. This rule has been listed as CVE-2018-3754 in the CVE registry.

Remediation
Use other third party library such as mysql.

Violation Code Sample

import * as query from 'query-mysql'

query.configure({
  'host': '127.0.0.1',
  'user': 'root',
  'password': 'root',
  'database': 'test'
})

query.base.fetchById('users', 'noob', 'username', (msg, res) => {
  console.log(msg, res)
})

Fixed Code Sample

import * as mysql from 'mysql'

var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3754 https://hackerone.com/reports/311244