SEC005: querystring-parameter

Named query parameter of type QueryString

Code	SEC005
Name	querystring-parameter
Category	Security (SEC)
Default severity	warning
Enabled by default	yes
Fix available	no
ign-lint equivalent	none

What it does

Reports named query parameters declared with type QueryString in the query's resource.json (attributes.parameters[].type). The finding points at the parameter's type.

Why is this bad?

A QueryString parameter is pasted into the SQL text ({name}) before the query runs; it is not bound like a Parameter (:name). Any caller that can run the query (a binding, a script, a client with the right permissions) controls part of the SQL statement: SQL injection, and broken statements for values containing quotes.

Use a Parameter for values. For a table or column name, keep a fixed set of queries, or check the value against a fixed list in a gateway script before running the query, and suppress the finding for that query with a per-file exclude for this rule.

Example

SELECT * FROM orders WHERE line = '{line}'

with line declared as QueryString. Use instead:

SELECT * FROM orders WHERE line = :line

with line declared as Parameter (type String).

---

Generated from the rule metadata by iglint generate-docs; iglint rule SEC005 prints the same page in the terminal. Source: docs/rules/SEC005.md.