Articles

Name: Interlace ESLint Ecosystem
Author: Ofri Peretz

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Filtered by tag #postgres · clear filter

Jan 2, 2026
PostgreSQL's COPY FROM Can Read /etc/passwd Into Your Database. One ESLint Rule Blocks It.
A deep dive into PostgreSQL filesystem exploits. Learn how to engineer static analysis guards to prevent unauthorized database-level file access.
#eslint#postgres#security+1
004 min0
Jan 2, 2026
One INSERT Loop Made Our CSV Import 500x Slower. One ESLint Rule Catches It Before It Ships.
A for-loop with an INSERT inside turned a 100ms bulk write into 50 seconds — 500x slower at 1,000 rows. pg/no-batch-insert-loop (CWE-1049) catches the N+1 pattern in CI, before it ships.
#eslint#postgres#performance+1
136 min0
Jan 2, 2026
search_path Hijacking: the PostgreSQL Attack That Turns SELECT * FROM users Into the Attacker's Table
Control a connection's search_path and every unqualified query silently resolves to your schema. The obscure-but-lethal PostgreSQL attack, why SET can't be parameterized, the real fixes, and the CWE-426 ESLint rule that catches it.
#eslint#postgres#security+1
8 min
Dec 31, 2025
BEGIN on a Postgres Pool Scatters Your Transaction Across Connections. One ESLint Rule Stops It.
pool.query('BEGIN') runs on a different pooled client than the UPDATE that follows it — so your 'transaction' isn't atomic and corrupts data under load. The race condition (CWE-362), the dedicated-client fix, and the pg ESLint rule that catches every BEGIN/COMMIT on a pool.
#eslint#postgres#node+1
5 min
Dec 31, 2025
A Missing client.release() Exhausted Our Postgres Pool at 3 AM. The ESLint Rule That Catches It.
A node-postgres connection leak took our API down: 100 connections gone in 2 minutes on normal traffic. The post-mortem, the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.
#eslint#postgres#node+1
005 min0
Dec 31, 2025
pg Lets You Concatenate SQL, Hijack search_path, and Leak Every Connection. 13 ESLint Rules Say No.
SQL injection, search_path schema hijacking, and the missing client.release() that exhausts your pool — node-postgres bugs that pass tests and take down production. 13 CWE-mapped ESLint rules that catch them in CI.
#eslint#postgres#node+1
9 min
Dec 31, 2025
Your node-postgres Data Layer Fails 4 Ways in Production. SQL Injection Is Only the First.
SQL injection is the famous node-postgres failure — but identifier hijacking, connection-pool exhaustion, and insecure transport page you at 3 AM just as hard. The four data-layer threat classes, the pg-specific ESLint rule for each, and the one config that turns them all on.
#eslint#postgres#node+1
6 min
Three SQL Injection Patterns That Still Ship in Node.js — And the ESLint Rule That Catches Them
Direct concatenation, template literals, and cross-line variable taint: the three structural forms of SQL injection in node-postgres codebases, why each survives code review, and how a pg-specific ESLint rule catches all three.
#security#postgres#node+1
005 min0