flawopen.com/SQL Injection in JavaScript/TypeORM

Is TypeORM's query builder safe from SQL injection?

Reference page — draft, pending review
Short answer

Yes for standard repository methods and its parameterized QueryBuilder conditions. Its query() raw-SQL method and unparameterized where() string arguments are the risk points.

UNSAFE
userRepo.createQueryBuilder("u")
  .where(`u.id = ${userId}`)
  .getOne()
SAFE
userRepo.createQueryBuilder("u")
  .where("u.id = :id", { id: userId })
  .getOne()

The rule

TypeORM's QueryBuilder.where() accepts a condition string with named placeholders (:id) plus a separate parameters object — that form is parameterized. Passing a template-literal-interpolated string directly as the condition bypasses parameterization entirely, identical to the same mistake in Knex or Sequelize.

How to check your codebase

grep -rn "\.where(\`\|\.query(\`" --include="*.ts" . | grep '\${'

FAQ

Are TypeORM's Repository find methods (find, findOne) always safe?

Yes — they build parameterized queries internally regardless of the value's content.

References