no-unsafe-query

CWE: CWE-89 OWASP: A03:2021 – Injection

Detects SQL injection in Prisma raw queries. This rule is part of eslint-plugin-prisma-security.

💼 This rule is set to error in the recommended config.

Quick Summary

Rule Details

Reports three shapes when they reach a raw-SQL sink:

1. String concatenation — prisma.$queryRawUnsafe('SELECT ... ' + value)
2. Template interpolation — prisma.$queryRawUnsafe(`SELECT ... ${value}`)
3. A variable tainted by either, including via +=, then passed to a sink

Sinks

$queryRawUnsafe() and $executeRawUnsafe() only. The safe $queryRaw / $executeRaw tagged templates parameterize their interpolations and are a different AST node, so they can never be reported.

❌ Incorrect

await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE id = ${userId}`);

await prisma.$queryRawUnsafe('SELECT * FROM users WHERE email = ' + email);

let sql = 'SELECT * FROM products WHERE 1=1';
sql += ` AND name = '${name}'`;
await prisma.$queryRawUnsafe(sql);

✅ Correct

await prisma.$queryRaw`SELECT * FROM User WHERE email = ${email}`;

Known limitations

• Only identifier member access is matched, so prisma['$queryRawUnsafe'](...) is a false negative.
• Taint tracking is single-scope and name-based — it does not follow a query string across function boundaries.

Implementation

The detection is shared across the driver plugins via createSqlInjectionRule in @interlace/eslint-devkit; this rule supplies Prisma's sinks and remediation copy. Install the plugin matching your stack and you get exactly one finding per line.

Further Reading

• Prisma — parameterized queries
• OWASP — SQL Injection
• CWE-89