Vulnerable to SQL Injection Attacks

[rharder]

Our Fortify scans alerted us to possible SQL injection attacks in sqldict.py, and upon inspection it does appear to have a number of SQL statements built with Python's string-building %s feature rather than sqlite's parameterized queries.

Is that something that can be fixed? It's giving our cyber team fits. =)

-Rob

[MattGPT-ai]

Any update on this? Our CVE is expiring soon, is there even any discussion about how this could possibly be fixed?

[rharder]

I’m trying to remember what we decided. I think that the places where there are not parameterized queries are only function calls that a developer would make with this or that string as an argument — and the developer already has complete control anyway.

So there’s little chance of “user supplied data” ending up in those function calls.

We moved on and approved the code for our use.