Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert check for incomplete parentheses #2674

Merged
merged 1 commit into from
Sep 25, 2019

Conversation

emirb
Copy link
Contributor

@emirb emirb commented Sep 25, 2019

Make sure these boxes checked before submitting your pull request.

  • Do only one thing
  • No API-breaking changes
  • New code/logic commented & tested

For significant changes like big bug fixes, new features, please open an issue to make an agreement on an implementation design/plan first before starting it.

What did this pull request do?

This reverts commit e3cc5ea from https://github.com/jinzhu/gorm/pull/2519 due to breaking of valid queries.

@codecov-io
Copy link

Codecov Report

Merging #2674 into master will decrease coverage by 0.08%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #2674      +/-   ##
==========================================
- Coverage   79.57%   79.49%   -0.09%     
==========================================
  Files          24       24              
  Lines        3472     3458      -14     
==========================================
- Hits         2763     2749      -14     
  Misses        609      609              
  Partials      100      100
Impacted Files Coverage Δ
scope.go 87% <ø> (-0.22%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c98e7d...17debe1. Read the comment docs.

@emirb emirb requested review from depado and jinzhu September 25, 2019 06:51
@depado
Copy link
Collaborator

depado commented Sep 25, 2019

Related issue: #2561

@jinzhu jinzhu merged commit 81c17a7 into go-gorm:master Sep 25, 2019
@jinzhu
Copy link
Member

jinzhu commented Sep 25, 2019

Thank you, sorry for the issue.

@emirb emirb deleted the revert-incomplete-parantheses branch September 26, 2019 16:58
@Jonathan34
Copy link

@jinzhu are you going to provide a version with a fix for this CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15562 ?
I can revert to 1.9.10 but i see some interesting bugs fixed in .11 and i might be impacted by the reason this was reverted...
Thanks!

@jinzhu
Copy link
Member

jinzhu commented Nov 12, 2019

Hi @Jonathan34

It's hard to make this one correct, suggest you don't accept user's input as the select params.

@mathieupost
Copy link

@Jonathan34
If you replace db.First(&m, id) by db.First(&m, "id = ?", id) you're safe.

laitanf pushed a commit to laitanf/gorm that referenced this pull request Feb 5, 2020
…o prevent SQL injection." (go-gorm#2674)"

This reverts commit 81c17a7.
laitanf pushed a commit to laitanf/gorm that referenced this pull request Feb 5, 2020
…ed parenthesis

Revert "Revert "Fix go-gorm#2517 : Check for incomplete parentheses to prevent SQL injection." (go-gorm#2674)"
blefevre pushed a commit to blefevre/gorm that referenced this pull request Feb 17, 2020
cgxxv pushed a commit to cgxxv/gorm that referenced this pull request Mar 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants