no-transaction-on-pool

CWE: CWE-693

⚠️ This rule errors by default in the recommended config.

Quick SummaryCopy Anchor Link

Rule DetailsCopy Anchor Link

pool.query() acquires a different client for each call. Transaction commands (BEGIN, COMMIT, ROLLBACK) on pool may execute on different connections, breaking transaction semantics.

❌ IncorrectCopy Anchor Link

// Each query might use a different connection!
await pool.query('BEGIN');
await pool.query('INSERT INTO users VALUES ($1)', [user]);
await pool.query('COMMIT'); // May commit nothing

✅ CorrectCopy Anchor Link

const client = await pool.connect();
try {
  await client.query('BEGIN');
  await client.query('INSERT INTO users VALUES ($1)', [user]);
  await client.query('COMMIT');
} catch (e) {
  await client.query('ROLLBACK');
  throw e;
} finally {
  client.release();
}

Error Message FormatCopy Anchor Link

⚠️ CWE-362 | Transaction command on pool causes race condition | HIGH
   Fix: Use pool.connect() and run transaction commands on the returned client

When Not To Use ItCopy Anchor Link

• Never disable this rule - transactions on pool are always incorrect

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Aliased and imported pools (detected since 2026-10)Copy Anchor Link

The receiver is followed to where it is created — through const db = pool, and through a relative import into the module that writes new Pool() (or declares the handle with pg's Pool type). An imported new Client() is a single connection, where a transaction is correct, and is not reported.

// ❌ REPORTED - ./db exports `new Pool()`
import { pool } from './db';
await pool.query('BEGIN');

Dynamic Query StringCopy Anchor Link

Why: Transaction commands in variables are not detected.

// ❌ NOT DETECTED - Query from variable
const cmd = 'BEGIN';
await pool.query(cmd);

Mitigation: Use literal query strings for transaction commands.

Wrapped Pool MethodsCopy Anchor Link

Why: Wrapper functions hide pool access.

// ❌ NOT DETECTED - Transaction in wrapper
async function runQuery(sql: string) {
  return pool.query(sql);
}
await runQuery('BEGIN'); // Wrapper not traced

Mitigation: Apply rule to all modules. Use dedicated transaction wrappers that enforce client pattern.

Transaction Commands in Template LiteralsCopy Anchor Link

Why: Complex template literals may hide transaction keywords.

// ❌ NOT DETECTED - Hidden in template
const action = 'BEGIN';
await pool.query(`${action}`);

Mitigation: Use explicit transaction management patterns. Create utility functions that enforce correct usage.

Related RulesCopy Anchor Link

• no-missing-client-release - Ensures client release

Use this rule

npm install -D oxlint-plugin-postgresql-security

{  "jsPlugins": ["oxlint-plugin-postgresql-security"],  "rules": {    "postgresql-security/no-transaction-on-pool": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-postgresql-security'],    rules: {      'postgresql-security/no-transaction-on-pool': 'error',    },  },});