From 54ec4009a10d3e1a1caf50f3f33af4b557d4f097 Mon Sep 17 00:00:00 2001 From: Russell Schmidt Date: Fri, 17 Jan 2025 12:21:31 -0600 Subject: [PATCH] Fix sql injection in update_ack_nak Messages with single quotes would send data directly to sqlite --- db_handler.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/db_handler.py b/db_handler.py index a8b323b..d58a8fe 100644 --- a/db_handler.py +++ b/db_handler.py @@ -53,12 +53,13 @@ def update_ack_nak(channel, timestamp, message, ack): db_cursor = db_connection.cursor() update_query = f""" UPDATE {get_table_name(channel)} - SET ack_type = '{ack}' - WHERE user_id = {str(globals.myNodeNum)} AND - timestamp = {timestamp} AND - message_text = '{message}' + SET ack_type = ? + WHERE user_id = ? AND + timestamp = ? AND + message_text = ? """ - db_cursor.execute(update_query) + + db_cursor.execute(update_query, (ack, str(globals.myNodeNum), timestamp, message)) db_connection.commit() except sqlite3.Error as e: