harden: add parameterized queries in PostgresClient.ts

[anupamme]

Summary

Harden input handling in JS/edgechains/arakoodev/src/db/src/lib/postgres-client/PostgresClient.ts (flagged by semgrep).

Vulnerability

Field	Value
ID	utils.custom.sql-injection-template-literal
Severity	HIGH
Scanner	semgrep
Rule	utils.custom.sql-injection-template-literal
File	JS/edgechains/arakoodev/src/db/src/lib/postgres-client/PostgresClient.ts:90
Assessment	Defensive hardening

Description: SQL query constructed using JavaScript template literals with dynamic input. This can lead to SQL injection. Use parameterized queries instead.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• JS/edgechains/arakoodev/src/db/src/lib/postgres-client/PostgresClient.ts

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: User input never appears in SQL queries without parameterization

Regression test

import { PostgresClient } from '../../../../src/db/src/lib/postgres-client/PostgresClient';

describe("User input never appears in SQL queries without parameterization", () => {
  const payloads = [
    "' OR 1=1 --",
    "'; DROP TABLE users; --",
    "valid_input_123"
  ];

  test.each(payloads)("handles input safely without SQL injection: %s", async (payload) => {
    const mockPool = {
      query: jest.fn().mockResolvedValue({ rows: [], rowCount: 0 }),
      connect: jest.fn(),
      end: jest.fn()
    };
    
    const client = new PostgresClient({} as any);
    (client as any).pool = mockPool;
    (client as any).upperLimit = 10;
    
    await client.execute(`SELECT * FROM test WHERE id = '${payload}'`);
    
    const calledQuery = mockPool.query.mock.calls[0]?.[0];
    const calledParams = mockPool.query.mock.calls[0]?.[1];
    
    // If parameters are used, query should not contain raw payload
    // If no parameters, query string should not have unescaped quotes
    const hasParameterizedQuery = Array.isArray(calledParams) && calledParams.length > 0;
    const payloadInQuery = calledQuery?.includes(payload);
    
    expect(hasParameterizedQuery || !payloadInQuery).toBe(true);
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[github-actions]

CLA Assistant Lite bot: Thank you for your submission, we really appreciate it. Before we can accept your contribution, we ask that you sign the Arakoo Contributor License Agreement. You can sign the CLA by adding a new comment to this pull request and pasting exactly the following text.

---

I have read the Arakoo CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request}