Security advisory GHSA-2777-2vq8-c4v4: SQL Injection in sequelize
Package: sequelize (npm), vulnerable version: 5.2.15, fixed in: 5.3.0
CWE: CWE-20
Files changed by the fix:
lib/dialects/abstract/connection-manager.js
lib/dialects/postgres/connection-manager.js

Fix diff:
diff --git a/lib/dialects/abstract/connection-manager.js b/lib/dialects/abstract/connection-manager.js
index c3e1b9eef69f..9d26e73d1765 100644
--- a/lib/dialects/abstract/connection-manager.js
+++ b/lib/dialects/abstract/connection-manager.js
@@ -256,7 +256,10 @@ class ConnectionManager {
             //avoiding a useless round trip
             if (this.sequelize.options.databaseVersion === 0) {
               return this.sequelize.databaseVersion(_options).then(version => {
-                this.sequelize.options.databaseVersion = semver.valid(version) ? version : this.defaultVersion;
+                const parsedVersion = _.get(semver.coerce(version), 'version') || version;
+                this.sequelize.options.databaseVersion = semver.valid(parsedVersion)
+                  ? parsedVersion
+                  : this.defaultVersion;
                 this.versionPromise = null;
                 return this._disconnect(connection);
               });
diff --git a/lib/dialects/postgres/connection-manager.js b/lib/dialects/postgres/connection-manager.js
index e2345073156e..d847c78a0ae1 100644
--- a/lib/dialects/postgres/connection-manager.js
+++ b/lib/dialects/postgres/connection-manager.js
@@ -122,6 +122,23 @@ class ConnectionManager extends AbstractConnectionManager {
       let responded = false;
 
       const connection = new this.lib.Client(connectionConfig);
+
+      const parameterHandler = message => {
+        switch (message.parameterName) {
+          case 'server_version':
+            if (this.sequelize.options.databaseVersion === 0) {
+              const version = semver.coerce(message.parameterValue).version;
+              this.sequelize.options.databaseVersion = semver.valid(version)
+                ? version
+                : this.defaultVersion;
+            }
+            break;
+          case 'standard_conforming_strings':
+            connection['standard_conforming_strings'] = message.parameterValue;
+            break;
+        }
+      };
+
       const endHandler = () => {
         debug('connection timeout');
         if (!responded) {
@@ -133,8 +150,19 @@ class ConnectionManager extends AbstractConnectionManager {
       // node-postgres does not treat this as an error since no active query was ever emitted
       connection.once('end', endHandler);
 
+      if (!this.sequelize.config.native) {
+        // Receive various server parameters for further configuration
+        connection.connection.on('parameterStatus', parameterHandler);
+      }
+
       connection.connect(err => {
         responded = true;
+
+        if (!this.sequelize.config.native) {
+          // remove parameter handler
+          connection.connection.removeListener('parameterStatus', parameterHandler);
+        }
+
         if (err) {
           if (err.code) {
             switch (err.code) {
@@ -166,11 +194,7 @@ class ConnectionManager extends AbstractConnectionManager {
     }).tap(connection => {
       let query = '';
 
-      if (
-        this.sequelize.options.databaseVersion !== 0
-        && semver.gte(this.sequelize.options.databaseVersion, '8.2.0')
-        && semver.lt(this.sequelize.options.databaseVersion, '9.1.0')
-      ) {
+      if (connection['standard_conforming_strings'] !== 'on') {
         // Disable escape characters in strings
         // see https://github.com/sequelize/sequelize/issues/3545 (security issue)
         // see https://www.postgresql.org/docs/current/static/runtime-config-compatible.html#GUC-STANDARD-CONFORMING-STRINGS