Remove usage of potentially unsafe SQL constructs #83

New Issue

joss · 2022-10-18T15:50:35-04:00

joss commented

2022-10-18 15:50:35 -04:00

Looks like https://git.csclub.uwaterloo.ca/public/pyceo/src/branch/master/ceod/db/MySQLService.py#L47 and the PostgreSQL equivalent are using f strings to format the queries they execute.

As far as I'm aware, this doesn't protect against SQL injection, and although I know everyone in the CSC are good, machine usage policy following people, it should probably be changed to use the safer constructs outlined here: https://www.psycopg.org/docs/usage.html#passing-parameters-to-sql-queries and the MySQL equivalents.

Should just be contained in ceod/db.

Looks like https://git.csclub.uwaterloo.ca/public/pyceo/src/branch/master/ceod/db/MySQLService.py#L47 and the PostgreSQL equivalent are using f strings to format the queries they execute. As far as I'm aware, this doesn't protect against SQL injection, and although I know everyone in the CSC are good, machine usage policy following people, it should probably be changed to use the safer constructs outlined here: https://www.psycopg.org/docs/usage.html#passing-parameters-to-sql-queries and the MySQL equivalents. Should just be contained in `ceod/db`.

joss commented

2022-10-19 11:43:53 -04:00

Actually this isn't really user facing, and probably isn't called with user-facing code so it's probably not an issue, but it's a pretty straightforward fix AFAIK.

q434zhan self-assigned this 2022-11-20 16:13:17 -05:00

merenber added the

priority

low

label 2023-10-14 22:19:06 -04:00

Sign in to join this conversation.