isudatateam / datateam

Audit required: Risk of possible SQL injection vector through string-based query construction BAN-B608
Security
Major
3 months ago3 months old
Possible SQL injection vector through string-based query construction.
157    """generalized datatable dumper."""
158    df = pd.read_sql(
159        text(
160            f"SELECT * from {tablename} WHERE siteid = ANY(:sites) "161            "ORDER by siteid"162        ),
163        pgconn,
164        params={"sites": sites},
Possible SQL injection vector through string-based query construction.
106            if val is None:
107                val = "Unknown"
108            values.append(val.strip())
109        sql = "INSERT into %s (%s) VALUES (%s)" % (110            tablename,111            ",".join(cols),112            ",".join(["%s"] * len(cols)),113        )114        cursor.execute(sql, values)
115    cursor.close()
116    pgconn.commit()
Possible SQL injection vector through string-based query construction.
103        )
104    for key in td:
105        td[key] = read_sql(
106            "SELECT * from %s" % (key,), pgconn_td, index_col=None107        )
108        # Translate entries for SERF_IA into SERF
109        td[key].loc[td[key]["uniqueid"] == "SERF_IA", "uniqueid"] = "SERF"
Possible SQL injection vector through string-based query construction.
 99    }
100    for key in cscap:
101        cscap[key] = read_sql(
102            "SELECT * from %s" % (key,), pgconn_cscap, index_col=None103        )
104    for key in td:
105        td[key] = read_sql(
Possible SQL injection vector through string-based query construction.
37        for key, val in row.items():
38            cols.append(cleankey(key))
39            values.append((val or "").strip())
40        sql = "INSERT into %s (%s) VALUES (%s)" % (41            tablename,42            ",".join(cols),43            ",".join(["%s"] * len(cols)),44        )45        cursor.execute(sql, values)
46    cursor.close()
47    pgconn.commit()