From 1942128c09cabf214cfc74b495f21bbeefe893b9 Mon Sep 17 00:00:00 2001 From: Mawoka Date: Thu, 7 Jul 2022 10:41:47 +0200 Subject: [PATCH] :rotating_light: Fixed vulnerable SQL-statement in migration --- migrations/versions/ff573859eb32_user_avatar.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/migrations/versions/ff573859eb32_user_avatar.py b/migrations/versions/ff573859eb32_user_avatar.py index 939946c..6671770 100644 --- a/migrations/versions/ff573859eb32_user_avatar.py +++ b/migrations/versions/ff573859eb32_user_avatar.py @@ -10,6 +10,8 @@ import asyncio from alembic import op import sqlalchemy as sa from sqlalchemy.orm import Session +from sqlalchemy.sql.functions import user + from classquiz.helpers.avatar import gzipped_user_avatar import ormar from classquiz.db.models import User @@ -31,7 +33,10 @@ def upgrade() -> None: for row in res: user_id = str(row).strip(",.'()") avatar = gzipped_user_avatar().hex() - session.execute(f"UPDATE users SET avatar = (decode('{avatar}', 'hex')) WHERE users.id='{user_id}'") + session.execute( + sa.sql.text("UPDATE users SET avatar = (decode(:avatar, 'hex')) WHERE users.id=:user_id"), + {"user_id": user_id, "avatar": avatar}, + ) op.alter_column("users", "avatar", nullable=False) # ### end Alembic commands ###