Penetration Testing With AWS Security Agent

sudo dnf install -y git
sudo dnf groupinstall "Development Tools" -y
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bashrc
nvm install 24
npm install -g pm2

git remote rename origin old-origin
git remote add origin https://gitlab.com/<GITLAB_REPO_URL>
git push --set-upstream origin --all
git push --set-upstream origin --tags

stages: [deploy]

deploy_ec2:
  stage: deploy
  image: alpine:latest
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  before_script:
    - apk add --no-cache openssh-client
    - chmod 600 "$SSH_PRIVATE_KEY"
  script:
    - |
      ssh -i "$SSH_PRIVATE_KEY" -o StrictHostKeyChecking=accept-new \
        "$EC2_USER@$EC2_HOST" \
        "REPO_URL='@gitlab.com/cloudfrontvinayak/juice-shop.git'">https://${DEPLOY_TOKEN_USER}:${DEPLOY_TOKEN}@gitlab.com/cloudfrontvinayak/juice-shop.git'" \
        bash -s <<'EOF'
      set -euo pipefail

      # --- clone on first run, pull afterwards ---
      if [ ! -d "$HOME/juice-shop/.git" ]; then
        git clone "$REPO_URL" "$HOME/juice-shop"
      else
        git -C "$HOME/juice-shop" remote set-url origin "$REPO_URL"
        git -C "$HOME/juice-shop" pull --ff-only
      fi

      # --- build and run ---
      cd "$HOME/juice-shop"
      npm install
      if pm2 describe juice-shop >/dev/null 2>&1; then
        pm2 reload juice-shop --update-env
      else
        PORT=3000 pm2 start npm --name juice-shop -- start
        pm2 save
        sudo env PATH="$PATH" pm2 startup systemd -u "$USER" --hp "$HOME" || true
      fi
      pm2 save
      pm2 status
      EOF

Why it fails

With Sequelize replacements, :criteria is substituted with a quoted, escaped string literal. Inside the SQL it sits between quotes already:

LIKE '%:criteria%'

Sequelize doesn't replace :criteria inside a quoted string, because it's part of a literal. So the query searches for the literal text :criteria, not the user's input. The injection is gone, but so is the search.

Correct fix

Put the wildcards in the value, and leave the placeholder unquoted:

models.sequelize.query(
  `SELECT * FROM Products
   WHERE ((name LIKE :criteria OR description LIKE :criteria) AND deletedAt IS NULL)
   ORDER BY name`,
  { replacements: { criteria: `%${criteria}%` } }
)

Sequelize then escapes the value and wraps it in quotes, so %foo% becomes '%foo%'.