grafeas / grafeas/grafeas

possible SQL injection?

Open
#577 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.6k
Forks
307
PR merge metrics
No merged PRs in 30d

Description

I might be wrong but from the looks of the code the NewPgSQLStore function is called from postgresStorageTypeProvider which looks like reads config. It probably isn't a real security issue since it would require access to the config for the database but the database name is not sanitized so SQL injection could happen.

go/v1beta1/storage/pgsqlstore.go
```
89 fmt.Sprintf("SELECT * FROM pg_catalog.pg_database WHERE datname='%s'", dbName))
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.