-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Potential security issue: Possible SQL injection in the SQLx implementation #2
Comments
Thanks for flagging this. Somewhat orthogonal, but there's also an open issue related to how the database URL is parsed: #1 I'm open to reworking this entirely to ensure better security and UX. |
Given my previous interactions with this project I'm not willing to work on a fix. I mostly filled that issue so that users are aware of that issue. It also might be worth to fill a rustsec advisory for this soon. |
SQLite and Postgres are protected by their respective input sanitizers. For example:
And MySQL does not allow configuration of the schema or table names and instead they are hardcoded. |
The current version of the
tower-sessions-sqlx-store
crate is vulnerable for sql injections as it usesformat!
on user provided potentially untrusted inputs:https://github.com/maxcountryman/tower-sessions/blob/763133104290abb3fc4af6bbfd7a19609cb9fc39/sqlx-store/src/postgres_store.rs#L91
The text was updated successfully, but these errors were encountered: