no-batch-insert-loop

CWE: CWE-693

⚠️ This rule warns by default in the recommended config.

Quick SummaryCopy Anchor Link

Rule DetailsCopy Anchor Link

Executing mutation queries in loops creates N+1 query problems, causing:

• Database connection exhaustion
• Slow execution times
• Transaction timeout issues

❌ IncorrectCopy Anchor Link

// N+1 inserts
for (const user of users) {
  await client.query('INSERT INTO users VALUES ($1, $2)', [user.id, user.name]);
}

// forEach with mutations
users.forEach(async (user) => {
  await pool.query('UPDATE users SET active = true WHERE id = $1', [user.id]);
});

// map with mutations
users.map((user) => client.query('INSERT INTO users VALUES ($1)', [user.id]));

✅ CorrectCopy Anchor Link

// Bulk insert with unnest
await client.query(
  'INSERT INTO users SELECT * FROM unnest($1::int[], $2::text[])',
  [users.map((u) => u.id), users.map((u) => u.name)],
);

// pg-format for batching
const values = users.map((u) => [u.id, u.name]);
await client.query(format('INSERT INTO users VALUES %L', values));

// ANY for bulk updates
await client.query('UPDATE users SET active = true WHERE id = ANY($1)', [
  userIds,
]);

Error Message FormatCopy Anchor Link

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-400 OWASP:A06 CVSS:7.5 | Uncontrolled Resource Consumption (ReDoS) detected | HIGH
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A06_2021/

Message ComponentsCopy Anchor Link

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Async IteratorsCopy Anchor Link

Why: The rule doesn't traverse for await...of as a loop type.

// ❌ NOT DETECTED
async function* getUsers() {
  yield* users;
}
for await (const user of getUsers()) {
  await client.query('INSERT INTO users VALUES ($1)', [user.id]);
}

Recursive FunctionsCopy Anchor Link

Why: Recursion creates implicit loops that require call graph analysis.

// ❌ NOT DETECTED
async function insertUsers(users: User[], i = 0): Promise<void> {
  if (i >= users.length) return;
  await client.query('INSERT INTO users VALUES ($1)', [users[i].id]);
  return insertUsers(users, i + 1); // Recursive N+1!
}

One round trip per ROWCopy Anchor Link

A loop is reported when its statement is the same on every pass and its parameters change — one row per round trip. A loop whose statement itself differs per pass (a migration runner reading a different file each time, an element of a list of statements, a statement built from the loop element) is a sequence of distinct statements and is not reported, nor is the identical statement repeated with no parameters.

Promise.all with MappingCopy Anchor Link

A row-WRITING statement (INSERT / UPDATE / DELETE / MERGE) inside .map(), .flatMap() or an Array.from(xs, mapper) mapper is reported whatever consumes the array (since 2026-10). Reads in Promise.all(ids.map(…)) stay quiet: that is the deliberate concurrency trade-off. A loop over chunks of an already-batched statement (unnest(…), jsonb_to_recordset(…), pg-format %L) is the remediation and is not reported, nor is keyset pagination with LIMIT in for (;;).

// ❌ REPORTED (since 2026-10) - Array.from pattern
const queries = Array.from(users, (u) =>
  client.query('INSERT INTO users VALUES ($1)', [u.id]),
);
await Promise.all(queries);

External Loop FunctionsCopy Anchor Link

Why: Queries called from a helper function inside a loop are not detected.

// ❌ NOT DETECTED
async function insertUser(user: User) {
  await client.query('INSERT INTO users VALUES ($1)', [user.id]);
}
for (const user of users) {
  await insertUser(user); // N+1 but rule can't see into helper
}

Workaround: Use UNNEST() for bulk inserts or ANY() for bulk updates.

When Not To Use ItCopy Anchor Link

• When processing results in a streaming fashion with backpressure
• For operations that must be transactionally isolated per item
• When using a batching library (e.g., DataLoader) that coalesces queries

Related RulesCopy Anchor Link

• no-select-all - Query performance

Use this rule

npm install -D oxlint-plugin-postgresql-security

{  "jsPlugins": ["oxlint-plugin-postgresql-security"],  "rules": {    "postgresql-security/no-batch-insert-loop": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-postgresql-security'],    rules: {      'postgresql-security/no-batch-insert-loop': 'error',    },  },});