Skip to content

Conversation

tskong
Copy link
Contributor

@tskong tskong commented Feb 9, 2022

No description provided.

@ahmad-moussawi
Copy link
Contributor

Curious to know more about this, and why it's needed

@tskong
Copy link
Contributor Author

tskong commented Feb 11, 2022

Hi, we did a veracode scan over the code and this was picked up. This fix is to address this issue, I'm hoping it's correct. The unit tests all pass.

 sonatype-2019-0547 The SqlKata package is vulnerable to SQL Injection. The ChangeToSqlValue function in QueryBuilder.dll does not escape single quotes (') in user-supplied input, which is used to construct and execute SQL queries. A remote attacker can exploit this behavior by supplying specially-crafted input, allowing them to alter the SQL query in order to exfiltrate or modify data in an affected database. 
@ahmad-moussawi
Copy link
Contributor

Actually, the ToString() method is not designed to be executed, but I don't think this will affect the output in a bad way.

@ahmad-moussawi ahmad-moussawi merged commit a1f8e3f into sqlkata:master Feb 13, 2022
@kmataru
Copy link

kmataru commented Mar 28, 2022

I am curious about this. Will there be any package release soon that wraps this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants