Azure-Samples / Azure-Samples/SQL-AI-samples

[Security] SQL Injection Vulnerability in ListTableTool.ts (MssqlMcp/Node/src/tools)

未關閉
#92 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
HTML
星號
331
分支
208
PR 合併指標
30 天內沒有已合併 PR

描述

## Summary
The `ListTableTool` class in the Node.js MCP sample is vulnerable to SQL injection attacks due to unsanitized user input being directly interpolated into a dynamic SQL query. This affects the `run()` method when filtering by schemas via the `parameters` array.

**Affected File:** [MssqlMcp/Node/src/tools/ListTableTool.ts](https://github.com/Azure-Samples/SQL-AI-samples/blob/main/MssqlMcp/Node/src/tools/ListTableTool.ts)

## Steps to Reproduce
1. Instantiate the `ListTableTool` and call `run()` with malicious input:
```json
{
"parameters": ["dbo'; SELECT name FROM sys.databases --"]
}

query becomes:
`SELECT TABLE_SCHEMA + '.' + TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
AND TABLE_SCHEMA IN ('dbo'; SELECT name FROM sys.databases --')
ORDER BY TABLE_SCHEMA, TABLE_NAME`

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。