Unclear whether input is sanitized / escaped

[andersengenolsen]

What was unclear or otherwise insufficient?

Unclear whether updating entity with query builder provides sufficient sanitation / escaping.

Example:

await theDataSource.getRepository(UserEntity) .createQueryBuilder() .update(UserEntity) .set({ firstName: accountData.firstName, lastName: accountData.lastName, phone: accountData.phone, address: accountData.address, city: accountData.city, postalNumber: accountData.postalNumber, country: accountData.country }) // @ts-ignore .where("id = :id", {id: userId}) .execute();

My question: Will the values inside set function be sanitized to prevent SQL injection?

Recommended Fix

Provide better documenation.

Additional Context

No response

Are you willing to resolve this issue by submitting a Pull Request?

No, I don’t have the time and I’m okay to wait for the community / maintainers to resolve this issue.