Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Vulnerability in Parameterized Queries
See original GitHub issueHi, I came across the same issue as below where my filter terms were being erroneously picked up by the blacklist check:
https://github.com/groveco/django-sql-explorer/issues/454
My query:
SELECT * from logentry WHERE logentry.action = 'delete';
Error displayed:
Query failed the SQL blacklist: DELETE
I used parameterized queries as a workaround instead of concat:
SELECT * from logentry WHERE logentry.action = $$action$$;
{"action": "'delete'"}
Then I realised this could be used to bypass the blacklist anywhere in the query string, for instance:
$$cmd$$ FROM logentry;
{"cmd": "DELETE"}
Obviously this is rather undesirable behaviour.
Issue Analytics
- State:
- Created 10 months ago
- Reactions:2
- Comments:7 (3 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
I confirm I was able to delete row in table.
Blacklist issue and vulnerability are two different problems. Let’s say the problem with the blacklist is solved and everything works correctly. To solve the vulnerability problem, need to take two steps.
"$$cmd$$ FROM logentry;"to"Delete FROM logentry;". In other words, need to apply all parameters first"Delete FROM logentry;"through the blacklist checks.