Fix #2517 : Check for incomplete parentheses to prevent SQL injection. #2519
Conversation
Codecov Report
@@ Coverage Diff @@
## master #2519 +/- ##
==========================================
+ Coverage 79.34% 79.42% +0.08%
==========================================
Files 24 24
Lines 3452 3466 +14
==========================================
+ Hits 2739 2753 +14
Misses 612 612
Partials 101 101
Continue to review full report at Codecov.
|
c9d79cd to
2deeb51
Compare
|
@emirb I've applied your comment. Can you check it again please? |
|
Thanks @herpiko. |
…j… (go-gorm#2519) Fix go-gorm#2517 : Check for incomplete parentheses to prevent SQL injection.
|
hi All |
|
@wahyuhadi you say the issue still exist. Could you please provide more information or an example of the code that is vulnerable please? Thank you, |
|
@sneko |
|
I see that you are passing, as a primary key, an interface from gin.Context. Since there is no prepare statement in this usecase, it seems logical that there is an issue in this example, wdyt ? But still, it seems necessary to use the specific gorm pattern to avoid SQL injection. @jinzhu maybe you can lightened us a bit more ? :) |
|
The injection id=id=1)) or 1=1-- , i call this double param injection If you change the injection id=email=some@email.com)) or 1=1-- The query will change with where email=some@email.con |
|
@wahyuhadi yes, I understood first time ;) |
What did this pull request do?
Fix for #2517