From 42f5d595f7eb494c49a7d99dd792efd68ce7eb1f Mon Sep 17 00:00:00 2001 From: Ayman-umme Date: Sun, 10 Aug 2025 01:42:54 +0530 Subject: [PATCH] fix: Patches potential SQL injection vector Replaces an insecure f-string based database query with a safe, parameterized query to prevent SQL injection vulnerabilities. --- app/vulnerable_sql.py | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 app/vulnerable_sql.py diff --git a/app/vulnerable_sql.py b/app/vulnerable_sql.py new file mode 100644 index 00000000..73061b88 --- /dev/null +++ b/app/vulnerable_sql.py @@ -0,0 +1,10 @@ +from sqlalchemy.sql import text + +class UserDAO: + def __init__(self, db_session): + self.db = db_session + + def get_user_by_username(self, username: str): + raw_query = text("SELECT * FROM users WHERE username = :username") + result = self.db.execute(raw_query, {"username": username}) + return result.fetchone() \ No newline at end of file