GHSA-vx58-fwwq-5g8j

## Summary

NocoBase <= 2.0.8 `plugin-workflow-sql` substitutes template variables directly into raw SQL strings via `getParsedValue()` without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.

## Affected Versions

- Affected: all versions through 2.0.8

## Details

The `SQLInstruction` in `packages/plugins/@nocobase/plugin-workflow-sql/src/server/SQLInstruction.ts` line 28 processes SQL templates:

```typescript // SQLInstruction.ts:28 const sql = processor.getParsedValue(node.config.sql || '', node.id).trim(); ```

Then executes the resulting string directly:

```typescript // SQLInstruction.ts:35 const [result] = await collectionManager.db.sequelize.query(sql, { transaction: this.workflow.useDataSourceTransaction(dataSourceName, processor.transaction), }); ```

`getParsedValue()` performs simple string substitution of `{{$context.data.fieldName}}` placeholders with values from the workflow trigger data. No escaping, quoting, or parameterized binding is applied.

When an admin creates a SQL node with a template like: ```sql SELECT * FROM users WHERE nickname = '{{$context.data.nickname}}' ```

Any user who triggers the workflow with a crafted value can break out of the string literal and inject arbitrary SQL.

## Proof of Concept

1. Login as admin 2. Create a collection-trigger workflow on the `users` table (mode: after create) 3. Add a SQL node with: ```sql SELECT id, nickname, email FROM users WHERE nickname = '{{$context.data.nickname}}' ``` 4. Enable the workflow 5. Create a user with nickname set to: `' UNION SELECT 1,version(),current_user --` 6. Check execution result:

```json [ { "id": 1, "nickname": "PostgreSQL 16.13 (Debian 16.13-1.pgdg13+1) on x86_64-pc-linux-gnu...", "email": "nocobase" } ] ```

The injected UNION SELECT returned the database version and current database user.

## Impact

Full database read/write access through SQL injection. An attacker who can trigger a workflow with a SQL node containing template variables from user-controlled data can extract credentials, modify records, or drop tables. The severity depends on the database user's privileges (full superuser access in the default Docker deployment).

## Suggested Fix

Use parameterized queries. Replace direct string substitution with Sequelize bind parameters:

```diff // SQLInstruction.ts - const sql = processor.getParsedValue(node.config.sql || '', node.id).trim(); + const { sql, bind } = processor.getParsedValueAsParams(node.config.sql || '', node.id); const [result] = await collectionManager.db.sequelize.query(sql, { + bind, transaction: ... }); ```