higlass / higlass/higlass-server
SQL injection vulnerability
Open
- Dominant language
- Python
- Stars
- 22
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
```
query = """
SELECT importance, chrOffset, fields FROM intervals
WHERE fields LIKE '%{}%'
ORDER BY importance DESC
LIMIT 10
""".format(text)
rows = c.execute(query).fetchall()
```
Maybe something upstream is santitizing `text`, but still, this is not good. Use the `?` instead.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.