mirror of
https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git
synced 2026-11-08 01:06:59 +08:00
Sebastion
dd9627b682
All user-controlled values interpolated into SQL WHERE clause fragments in transTreeItem() and getSysVariableValue() are now passed through _escape_sql_value() which doubles single quotes (standard SQL escaping) and escapes backslashes. The logic operator in transTreeToWhere() is also validated against a whitelist. Affected injection vectors: - item["enum_value"] list (enum filter) - item["value"] string (normal filter) - user variable values (variable filter) - current_user name/account/email (system variable filter) - tree["logic"] operator (tree structure)