Azure-Samples / Azure-Samples/SQL-AI-samples
[Security] SQL Injection Vulnerability in ListTableTool.ts (MssqlMcp/Node/src/tools)
- 主要語言
- HTML
- 星號
- 331
- 分支
- 208
- PR 合併指標
- 30 天內沒有已合併 PR
描述
## Summary
The `ListTableTool` class in the Node.js MCP sample is vulnerable to SQL injection attacks due to unsanitized user input being directly interpolated into a dynamic SQL query. This affects the `run()` method when filtering by schemas via the `parameters` array.
**Affected File:** [MssqlMcp/Node/src/tools/ListTableTool.ts](https://github.com/Azure-Samples/SQL-AI-samples/blob/main/MssqlMcp/Node/src/tools/ListTableTool.ts)
## Steps to Reproduce
1. Instantiate the `ListTableTool` and call `run()` with malicious input:
```json
{
"parameters": ["dbo'; SELECT name FROM sys.databases --"]
}
query becomes:
`SELECT TABLE_SCHEMA + '.' + TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
AND TABLE_SCHEMA IN ('dbo'; SELECT name FROM sys.databases --')
ORDER BY TABLE_SCHEMA, TABLE_NAME`
貢獻指南
評估
這個 Issue 還沒有評估資料。