wordnote icon indicating copy to clipboard operation
wordnote copied to clipboard

Published 20 hours ago • verified publisher icon zehfernandes

Sanitize input before querying the database

Open DAlperin opened this issue 2 years ago • 1 comments

I'm not 100% sure but it kind of feels like words aren't being properly escaped in the SQL queries. Putting a 'or 1=1; on a line seems to pretty consistently mess things up and or crash the app for me. I was looking in the Editor.js files and it kind of looks like there is just raw string interpolation happening in the queries but I'm not sure.

Super cool app though :) I really like it so far.

DAlperin avatar Aug 01 '22 04:08 DAlperin

Good catch! You are right a sanitization before query the DB will fix the problem.

zehfernandes avatar Aug 04 '22 02:08 zehfernandes