higlass / higlass/higlass-server

SQL injection vulnerability

Open
#92 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
22
Forks
22
PR merge metrics
No merged PRs in 30d

Description

```
query = """
SELECT importance, chrOffset, fields FROM intervals
WHERE fields LIKE '%{}%'
ORDER BY importance DESC
LIMIT 10
""".format(text)

rows = c.execute(query).fetchall()
```

Maybe something upstream is santitizing `text`, but still, this is not good. Use the `?` instead.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.