[anupamme]

The export.mjs script constructs SQL queries dynamically by joining WHERE clause fragments. While the current implementation is safe due to hardcoded column names and parameterized values using prepared statement placeholders (?), the dynamic string concatenation pattern is flagged as a potential SQL injection risk. This pattern could become vulnerable if future modifications introduce user-controlled column names or if developers copy this pattern incorrectly for other queries. The affected code is linkedin-growth/scripts/export.mjs:20. This change is the fix I would apply.

Reference: CWE-89

What changed

• linkedin-growth/scripts/export.mjs

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[KirillSergeevich]

Thanks for the suggestion. We're closing this because the current code is not injectable. The WHERE fragments are fixed string literals ('owner_account = ?', 'status = ?'), and every user-supplied value is bound through the ? placeholders in db.prepare(sql).all(...vals). The rewrite runs the same four queries, and the branch-per-combination form scales worse as filters are added.

[anupamme]

Thanks for reviewing this. You’re right that the current implementation binds all user-supplied values and uses fixed SQL fragments, so the reported SQL injection risk isn’t exploitable in the existing code. I’ll treat this as a false positive.