no-select-all

CWE: CWE-693

Discourages SELECT * in favor of explicit column lists.

⚠️ This rule warns by default in the recommended config.

Quick SummaryCopy Anchor Link

Rule DetailsCopy Anchor Link

SELECT * fetches all columns, which can:

• Transfer unnecessary data
• Break when schema changes
• Prevent query plan optimizations

❌ IncorrectCopy Anchor Link

await client.query('SELECT * FROM users WHERE id = $1', [id]);

await pool.query('SELECT a, b, * FROM table'); // Mixed

✅ CorrectCopy Anchor Link

await client.query('SELECT id, name, email FROM users WHERE id = $1', [id]);

// COUNT(*) is acceptable
await pool.query('SELECT COUNT(*) FROM users');

// `*` over a CTE or derived table whose own SELECT lists the columns
await pool.query('WITH recent AS (SELECT id, total FROM orders) SELECT * FROM recent');
await pool.query('SELECT * FROM (SELECT id, email FROM users) AS u');

Error Message FormatCopy Anchor Link

📋 | Avoid SELECT * - explicitly list required columns | LOW
   Fix: Replace * with specific column names

When Not To Use ItCopy Anchor Link

• In development/debugging scripts
• When schema is stable and all columns are needed

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Dynamic Query ConstructionCopy Anchor Link

Why: Queries built at runtime are not analyzed.

// ❌ NOT DETECTED - Query from variable
const query = 'SELECT * FROM users';
await client.query(query);

Mitigation: Use template literals directly in query calls. Enable strict query typing.

Query in String VariableCopy Anchor Link

Why: String contents from variables are not traced.

// ❌ NOT DETECTED - Query concatenation
const cols = '*';
await client.query(`SELECT ${cols} FROM users`);

Mitigation: Use explicit column lists stored in typed constants.

Imported Query StringsCopy Anchor Link

Why: Queries from other modules are not visible.

// ❌ NOT DETECTED - Query from import
import { USERS_QUERY } from './queries'; // Contains SELECT *
await client.query(USERS_QUERY);

Mitigation: Apply this rule to query files. Use query builders with column selection.

ORM Generated QueriesCopy Anchor Link

Why: ORMs may generate SELECT * internally.

// ❌ NOT DETECTED - ORM may use SELECT * under the hood
const users = await User.find({ where: { active: true } });

Mitigation: Configure ORM to select explicit fields. Use projections/select options.

Related RulesCopy Anchor Link

• no-batch-insert-loop - Performance patterns

Use this rule

npm install -D oxlint-plugin-postgresql-security

{  "jsPlugins": ["oxlint-plugin-postgresql-security"],  "rules": {    "postgresql-security/no-select-all": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-postgresql-security'],    rules: {      'postgresql-security/no-select-all': 'error',    },  },});