Language: TypeScript
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
  new: async function (name = null, creatorId = null) {
    if (!name) return { result: null, message: "name cannot be null" };
    var slug = slugify(name, { lower: true });

    const existingBySlug = await this.get(`slug = '${slug}'`);
    if (existingBySlug !== null) {
      const slugSeed = Math.floor(10000000 + Math.random() * 90000000);
      slug = slugify(`${name}-${slugSeed}`, { lower: true });
    }

    const db = await this.db();
    const { id, success, message } = await db
      .run(`INSERT INTO ${this.tablename} (name, slug) VALUES (?, ?)`, [
        name,
        slug,
      ])
      .then((res) => {
        return { id: res.lastID, success: true, message: null };
      })
      .catch((error) => {
        return { id: null, success: false, message: error.message };
      });

    if (!success) {
      db.close();
      return { workspace: null, message };
    }

    const workspace = await db.get(
      `SELECT * FROM ${this.tablename} WHERE id = ${id}`
    );
    db.close();

    // If created with a user then we need to create the relationship as well.
    // If creating with an admin User it wont change anything because admins can
    // view all workspaces anyway.
    if (!!creatorId) await WorkspaceUser.create(creatorId, workspace.id);
    return { workspace, message: null };
  },