Security advisory GHSA-hx5x-49mm-vmhw: SQL Injection in sails-mysql
Package: sails-mysql (npm), vulnerable version: 0.10.7, fixed in: 0.10.8
CWE: CWE-89
Files changed by the fix:
b/lib/adapter.js
b/lib/connections/spawn.js
b/lib/sql.js

Fix diff:
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.7/lib/adapter.js /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.8/lib/adapter.js
--- a/lib/adapter.js
+++ b/lib/adapter.js
@@ -30,7 +30,7 @@
 // string queries to be elegantly displayed (see wl2
 // or tweet @mikermcneil for status of this feature or
 // to help out)
-var LOG_QUERIES = false;
+var LOG_QUERIES = process.env.LOG_QUERIES === 'true';
 
 module.exports = (function() {
 
@@ -841,9 +841,9 @@
       }
     },
 
-      // Count one model from the collection
-      // using where, limit, skip, and order
-      // In where: handle `or`, `and`, and `like` queries
+    // Count one model from the collection
+    // using where, limit, skip, and order
+    // In where: handle `or`, `and`, and `like` queries
     count: function(connectionName, collectionName, options, cb, connection) {
 
       if(_.isUndefined(connection)) {
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.7/lib/connections/spawn.js /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.8/lib/connections/spawn.js
--- a/lib/connections/spawn.js
+++ b/lib/connections/spawn.js
@@ -78,7 +78,25 @@
       return cb__spawnConnection(err);
     }
 
+    /**
+     * Runs a query on a connection, adding metadata to the error nicely :)
+     * @param  {String} statement
+     */
+    var oldQuery = liveConnection.query;
+    liveConnection.query = function (statement) {
+      // Turn the arguments into a usable array
+      var args = [].slice.call(arguments);
 
+      // Remove the callback that's there currently, then wrap it with
+      // our own which populates the original query.
+      var cb = args.pop();
+      args.push(function (err) {
+        if (err) err.query = statement;
+        cb.apply(this, arguments);
+      });
+
+      oldQuery.apply(liveConnection, args);
+    };
 
     // Now that we have the live connection, run our adapter logic.
     // i.e. run `fn`, a function which, amongst other things, should do something
@@ -87,7 +105,7 @@
 
       // Handle errors passed back from our adapter logic.
       if (err) {
-        
+
         // Release the connection, then pass control back to Waterline core.
         connectionObject.connection.releaseConnection(liveConnection, function sendBackError ( /* thisErrDoesntMatter */ ) {
           cb__spawnConnection(err);
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.7/lib/sql.js /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.8/lib/sql.js
--- a/lib/sql.js
+++ b/lib/sql.js
@@ -83,7 +83,7 @@
 
       // If type is an integer, set auto increment
       if(type === 'INT') {
-        return attrName + ' ' + type + ' NOT NULL AUTO_INCREMENT PRIMARY KEY';
+        return attrName + ' INT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY';
       }
 
       // Just set NOT NULL on other types
@@ -395,6 +395,9 @@
     case 'time':
       return 'TIME';
 
+    case 'binary':
+      return 'BLOB';
+
     default:
       console.error('Unregistered type given: ' + type);
       return 'LONGTEXT';
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.7/package.json /home/ubuntu/closed-source-intelligence/data/cache/npm-tarballs/sails-mysql-0.10.8/package.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sails-mysql",
-  "version": "0.10.7",
+  "version": "0.10.8",
   "description": "MySQL adapter for Sails.js",
   "main": "lib/adapter.js",
   "scripts": {
@@ -24,7 +24,7 @@
     "lodash": "~2.4.1",
     "mysql": "~2.3.0",
     "waterline-errors": "~0.10.0",
-    "waterline-sequel": "~0.0.10",
+    "waterline-sequel": "~0.0.19",
     "waterline-cursor": "~0.0.5"
   },
   "devDependencies": {