使用Node Oracledb标准GET配置时，为何收到‘HTTP参数Unsanitized输入流入send’提示？

当前环境为Angular前端搭配Node后端，数据库使用Oracle，依赖oracledb包。触发错误的代码位于Controller中的res.send(rows);行。

前端GET请求示例 #

getJobResult(id): Observable<JobResult[]> {
  const url = environment.hosturl + "job";
  const httpOptions = {
    headers: new HttpHeaders({
      "Access-Control-Allow-Origin": "*",
      "Content-Type": "application/json",
    }),
    withCredentials: true,
    params: {
      id: id,
    },
  };
  return this._http.get(url, httpOptions).pipe(
    map((res) => {
      if (res[0] && JSON.stringify(res[0]).includes("ERROR_MSG")) {
        // GET结果出错
        this.router.navigate(["/error"]);
      }
      
      return <JobResult[]>res;
    })
  );
}

API后端Controller示例 #

const job = require('../db_apis/job.js');

async function get(req, res, next) {
  try {
    const context = {};
    context.id = req.query.id;

    const rows = await job.find(context);

    res.send(rows);
    
  } catch (err) { 
    res.sendStatus(404);
    next(err);
  }
}

module.exports.get = get;

上述代码中的res.send(rows);行正是触发错误提示的位置。

API的DB API文件示例 #

const database = require('../services/database.js');

async function find(context) {
  let query = `SELECT  * FROM JOB WHERE JOB_ID = :V_ID`
  
  console.log(query);
  const binds = {
    V_ID: Number(context.id)
  };
  const result = await database.simpleExecute(query, binds, clientdetails);
  return result.rows;
}

module.exports.find = find;

执行的simpleExecute函数 #

async function simpleExecute(query, binds = [], clientdetails = [], opts = {}) {
  let conn;
  // 根据用户设置连接池
  let alias = 'client1';
  let simpleResult;
  console.log('Action for Client: ' + alias)

  opts.outFormat = oracledb.OBJECT;
  opts.autoCommit = true;

  try {
    // 获取连接
    conn = await oracledb.getConnection(alias);
    conn.callTimeout = 500 * 1000; // 将超时时间缩短至50秒
    // 执行语句
    simpleResult = await conn.execute(query, binds, opts);
  } catch (err) {
    console.error("Oracle Error ==>", err, "<== 此处显示Oracle错误！"); 
  } finally {
    // 最终关闭连接
    if (conn) {
      try {
        await conn.close();
        console.log('连接已关闭。')
      } catch (err) {
        console.log('关闭连接时出错: ' + err);
      }
      // 返回结果
      console.log('结果已返回。');
      return simpleResult
    }
  } 
}

module.exports.simpleExecute = simpleExecute;

内容的提问来源于stack exchange，提问作者user68288